Description
PassGo SSO Plus 2.1.0.32, and probably earlier versions, uses insecure permissions (Everyone/Full Control) for the PassGo Technologies directory, which allows local users to gain privileges by modifying critical programs.
References
- 22301 third-party-advisory
- ADV-2006-4660 vdb-entry
- 20061122 Secunia Research: PassGo SSO Plus Insecure Default DirectoryPermissions mailing-list
- http://secunia.com/secunia_research/2006-68/advisory
- 1017272 vdb-entry
- 21244 vdb-entry
- ssoplus-directory-insecure-permissions(30475) vdb-entry