Parallels Workstation - Rogue autostart..

[Thierry Zoller <Thierry () Zoller lu>]

Dear List,
YARAS, Yet Another Rogue Autostart....

Below you find the mail I send to Parallel on the 23 of Septembre.

unlike stated in the text, rogue autostart also happens when
installing the application. No priviledge escalation so far so the
issue is no biggie. Still I would have liked a reaction form the
vendor.

Anyways, Parallel did not care to reply and did not fix the "bug". I
decided to post this here for everybody to know.
-- 
http://secdev.zoller.lu
Thierry Zoller

===8<=================== Original Nachrichtentext ===================


Dear Parallels Team,

I came across a small sec. issue during uninstallation of your
program. (See that screenshots attached)

The program PRLDHCP is shelled without the usage of QUOTES in the
path, leading to the execution of c:\program.exe (without elevation of
priviledges) That said it is only an issue as an auto start vector.

This might be a Macrovision issue but I don't think so.

-- 
http://secdev.zoller.lu
Thierry Zoller
===8<============== Ende des Original Nachrichtentextes =============

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/