Alienware Command Center 2.8.8.0 Local Privilege Escalation


Vendor: Alienware Corporation
Product web page: http://www.alienware.com
Affected version:  2.8.8.0

Summary: Alienware Command Center is a software program developed
by Alienware. The most common release is 2.8.8.0, with over 98% of
all installations currently using this version. During setup, the
program creates a startup registration point in Windows in order to
automatically start when any user boots the PC. Upon being installed,
the software adds a Windows Service which is designed to run continuously
in the background. Manually stopping the service has been seen to cause
the program to stop functing properly. It adds a background controller
service that is set to automatically run. Delaying the start of this
service is possible through the service manager. A scheduled task is
added to Windows Task Scheduler in order to launch the program at various
scheduled times (the schedule varies depending on the version). The primary
executable is named AlienFusion.exe. The setup package generally installs
about 99 files and is usually about 19.05 MB (19,979,162 bytes).

Desc: The application suffers from an unquoted search path issue impacting
the service 'ioloenergybooster' for Windows deployed as part of Alienware
Command Center. This could potentially allow an authorized but non-privileged
local user to execute arbitrary code with elevated privileges on the system.
A successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user’s code would execute with the elevated privileges
of the application.

Tested on: Microsoft Windows 8


Vulnerability discovered by Humberto Cabrera
                            @dniz0r


Advisory ID: ZSL-2015-5229
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5229.php


24.02.2015

--


 
C:\Windows\System32>sc qc ioloenergybooster
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: ioloenergybooster
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Alienware\Command Center\ioloEnergyBooster.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : ioloEnergyBooster
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\Windows\System32>