Description
South River Technologies WebDrive 9.02 build 2232 installs the WebDrive Service without a security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable, or (3) restart the service via the start command.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- South River Technologies WebDrive Service 9.02 build 2232 - Bad Security Descriptor Privilege Escalation EDB-11264 · local · Jan 26, 2010
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 37083 third-party-advisory
- http://retrogod.altervista.org/9sg_south_river_priv.html
- 59080 vdb-entry
- ADV-2009-2994 vdb-entry
- 20091020 South River Technologies WebDrive Service Bad Security Descriptor Local Elevation Of Privileges mailing-list
- webdrive-webdrive-privilege-escalation(53885) vdb-entry