[Seguridad] Sysinternals PsTools Fails...

Sysinternals PsTools Fails to Disconnect Share Access Allowing Local
Users to Gain Administrative Access on Remote Systems
http://www.securitytracker.com/aler...10737.html


SecurityTracker Alert ID: 1010737
SecurityTracker URL: http://securitytracker.com/id?1010737

Date: Jul 19 2004
Impact: Root access via network

Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes

Version(s): 2.01, 2.02, and 2.03

Description: Some vulnerabilities were reported in Sysinternals
PsTools. A local user can gain administrative access on certain remote
hosts.

Computer Associates reported that several of the PsTools utilities map
the IPC$ or ADMIN$ share when executing a command on a remote host but
do not properly disconnect from the share when the utility exits. As a
result, a local user can access the share and take administrative
actions on the target system.

The following utilities are affected:

psexec 1.52, psgetsid 1.4, psinfo 1.5, pskill 1.03, pslist 1.25,
psloglist 2.5, pspasswd 1.21, psservice 2.1, psshutdown 2.31,
pssuspend 1.04.

PsTools 2.01, 2.02, and 2.03 are also affected.

Alan Ridgeway of Computer Associates is credited with discovering
these flaws.

Impact: A local user can gain administrative access on remote hosts
managed by PsTools in certain cases.

Solution: The vendor has issued a fixed version (2.05), available at:

http://www.sysinternals.com/ntw2k/f...ools.shtml

The vendor has also issued fixes for the following components:

PsExec (1.54):
http://www.sysinternals.com/ntw2k/f...exec.shtml

PsGetsid (1.41):
http://www.sysinternals.com/ntw2k/f...tsid.shtml

PsInfo (1.61):
http://www.sysinternals.com/ntw2k/f.../psinfo.sh tml

PsKill (use 1.03 from PsTools 2.05):
http://www.sysinternals.com/ntw2k/f...kill.shtml

PsList (1.26):
http://www.sysinternals.com/ntw2k/f...list.shtml

PsLoglist (2.51):
http://www.sysinternals.com/ntw2k/f...list.shtml

PsPasswd (use version 1.21 from PsTools 2.05):
http://www.sysinternals.com/ntw2k/f...sswd.shtml

PsService (2.12):
http://www.sysinternals.com/ntw2k/f...vice.shtml

PsSuspend (1.05):
http://www.sysinternals.com/ntw2k/f...pend.shtml

PsShutdown (2.32):
http://www.sysinternals.com/ntw2k/f...down.shtml

Vendor URL: www.sysinternals.com/ (Links to External Site)

Cause: Access control error, State error
Underlying OS: Windows (Any)
Message History: None.


Meritorios de Filtrado (Kill-File Global):
tella llop, jm (N.B. 2003.10.25)


«Prefiero molestar con la verdad que complacer con adulaciones (Lucio Anneo Seneca)»