======================================================================
Secunia Research 2016/11/10
WibuKey Runtime for Windows IOCTL 0x8200E804
Privilege Escalation Vulnerability
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9
======================================================================
1) Affected Software
* WibuKey Runtime for Windows version 6.32 (wibukey.sys version
6.12.1215.500). Other versions may also be affected.
======================================================================
2) Severity
Rating: Less critical
Impact: Privilege escalation
Where: From local system
======================================================================
3) Description of Vulnerability
Secunia Research has discovered a vulnerability in WibuKey Runtime for
Windows, which can be exploited by malicious, local users to gain
escalated privileges.
The vulnerability is caused due to a boundary error in the wibukey.sys
driver when handling IOCTL 0x8200E804 and can be exploited to e.g.
cause a paged pool based buffer overflow.
Successful exploitation of this vulnerability may allow execution of
arbitrary code with kernel privileges.
======================================================================
4) Solution
Update to version 6.40.
======================================================================
5) Time Table
2016/03/11 - Vendor notified about vulnerability.
2016/03/13 - Vendor acknowledgement about receipt.
2016/04/07 - Vendor confirms issue and schedules intended fixed
version 6.40 for 2016/06/30.
2016/07/04 - Requested status update due to version 6.40 not being
publicly available.
2016/07/05 - Vendor confirms a release delay. Schedules intended
fixed version 6.40 for 2016/08/12.
2016/08/16 - Vendor confirms a further release delay. Schedules
intended fixed version 6.40 for 2016/10/17.
2016/08/16 - Acknowledged delay and notified vendor that no further
delay is acceptable due to disclosure policy and a
Secunia Advisory will be released regardless of a fix
being available or not.
2016/11/10 - Release of Secunia Advisory SA65535 and public
disclosure of Secunia Research Advisory.
2016/12/23 - Update of SA65535 and the Secunia Research advisory due
to a fixed version release.
======================================================================
6) Credits
Discovered by Dmitry Janushkevich, Secunia Research at Flexera
Software.
======================================================================
7) References
Currently no Common Vulnerabilities and Exposures (CVE) identifier is
assigned.
======================================================================
8) About Flexera Software
Flexera Software helps application producers and enterprises increase
application usage and the value they derive from their software.
http://www.flexerasoftware.com/enterprise/company/about/
Flexera Software delivers market-leading Software Vulnerability
Management solutions enabling enterprises to proactively identify and
remediate software vulnerabilities, effectively reducing the risk of
costly security breaches.
http://www.flexerasoftware.com/enterprise/products/
Flexera Software supports and contributes to the community in
several ways. We have always believed that reliable vulnerability
intelligence and tools to aid identifying and fixing vulnerabilities
should be freely available for consumers to ensure that users,
who care about their online privacy and security, can stay secure.
Only a few vendors address vulnerabilities in a proper way and help
users get updated and stay secure. End-users (whether private
individuals or businesses) are otherwise left largely alone, and
that is why back in 2002, Secunia Research started investigating,
coordinating disclosure and verifying software vulnerabilities.
In 2016, Secunia Research became a part of Flexera Software
and today our in-house software vulnerability research remains the
core of the Software Vulnerability Management products at
Flexera Software.
http://secunia.com/secunia_research/
The public Advisory database contains sufficient information for
researchers, security enthusiasts, and consumers to lookup individual
products and vulnerabilities and assess, whether they need to take
any actions to secure their systems or whether a given vulnerability
has already been discovered
http://secunia.com/advisories/
======================================================================
9) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2016-15/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
|