Ivanti Workspace Control Data Security bypass via localhost UNC path

["Securify B.V." <lists () securify nl>]

------------------------------------------------------------------------
Ivanti Workspace Control Data Security bypass via localhost UNC path
------------------------------------------------------------------------
Yorick Koster, August 2018

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
Ivanti Workspace Control contains a flaw where it is possible to access
folders that should be protected by Data Security. A local attacker can
bypass these restrictions using localhost UNC paths. Depending on the
NTFS permissions it may be possible for local users to access files and
folders that should be protected using Data Protection.

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully verified on Ivanti Workspace Control version
10.2.700.1 & 10.2.950.0.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue was resolved in Ivanti Workspace Control version 10.3.0.0.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20180803/ivanti-workspace-control-data-security-bypass-via-localhost-unc-path.html