Description
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Adobe Acrobat 9.1.2 NOS - Local Privilege Escalation EDB-9223 · local · Jul 21, 2009 · verified
- Adobe 9.x Related Service - 'getPlus_HelperSvc.exe' Local Privilege Escalation EDB-9199 · local · Jul 20, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 9199 exploit
- TA09-286B third-party-advisory
- 1023007 vdb-entry
- http://www.adobe.com/support/security/bulletins/apsb09-15.html
- oval:org.mitre.oval:def:5719 vdb-entry signature
- 35740 vdb-entry
- ADV-2009-1969 vdb-entry
- http://retrogod.altervista.org/9sg_adobe_local.html
- getplus-nos-insecure-permissions(54383) vdb-entry
- 35930 third-party-advisory
- 20090720 Adobe related service (getPlus_HelperSvc.exe) local elevation of privileges mailing-list
- ADV-2009-2898 vdb-entry
- 36331 third-party-advisory
- http://blogs.adobe.com/psirt/2009/07/local_privilege_escalation_in.html