Skip to navigation Skip to main content Skip to footer

Cisco VPN Client Privilege Escalation

Summary – 28.06.2011

Name: Cisco VPN Client Privilege Escalation
Reference: NGS00051
Discoverer: Gavin Jones 
Vendor: Cisco
Vendor Reference:
Systems Affected: Cisco VPN client (Windows 64 Bit)
Risk: High
Status: Fixed

TimeLine

Discovered: 15 February 2011
Released: 15 February 2011
Approved: 15 February 2011
Reported: 22 February 2011
Fixed: 24 March 2011
Published: 28 June 2011

Description

The 64 Bit Cisco VPN Client for Windows 7 is affected by a local privilege escalation vulnerability that allows non-privileged users to gain administrative privileges.

Technical Details

Unprivileged users can execute arbitrary programs that run with the privileges of the LocalSystem account by replacing the Cisco VPN Service executable with arbitrary executables. This vulnerability exists because the default file permissions assigned during installation to cvpnd.exe (the executable for the Cisco VPN Service) allow unprivileged, interactive users to replace cvpnd.exe with any file.

Because the Cisco VPN Service is a Windows service running with LocalSystem privileges, unprivileged users can easily elevate their privileges.

It is possible to work around this vulnerability without a software upgrade.

The permissions applied to the file by default are shown below:

C: >cacls “C:Program Files (x86)Cisco SystemsVPN Clientcvpnd.exe”

C:Program Files (x86)Cisco SystemsVPN Clientcvpnd.exe

BUILTINUsers:R
BUILTINAdministrators:F
NT AUTHORITYSYSTEM:F
NT AUTHORITYINTERACTIVE:F
NT AUTHORITYSYSTEM:F

Fix Information

An effective workaround for this vulnerability is to revoke access rights for NT AUTHORITYINTERACTIVE from cvpnd.exe. For example:

“C:Program Files (x86)Cisco SystemsVPN Client>cacls cvpnd.exe /E /R “NT AUTHORITYINTERACTIVE”