Secunia Research: WibuKey Runtime for Windows IOCTL 0x8200E804 Privilege Escalation Vulnerability

======================================================================

                    Secunia Research 2016/11/10

           WibuKey Runtime for Windows IOCTL 0x8200E804
                 Privilege Escalation Vulnerability

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9

======================================================================
1) Affected Software

* WibuKey Runtime for Windows version 6.32 (wibukey.sys version
  6.12.1215.500). Other versions may also be affected.

======================================================================
2) Severity

Rating: Less critical
Impact: Privilege escalation
Where:  From local system

======================================================================
3) Description of Vulnerability

Secunia Research has discovered a vulnerability in WibuKey Runtime for
Windows, which can be exploited by malicious, local users to gain
escalated privileges.

The vulnerability is caused due to a boundary error in the wibukey.sys
driver when handling IOCTL 0x8200E804 and can be exploited to e.g.
cause a paged pool based buffer overflow.

Successful exploitation of this vulnerability may allow execution of
arbitrary code with kernel privileges.

======================================================================
4) Solution

Update to version 6.40.

======================================================================
5) Time Table

2016/03/11 - Vendor notified about vulnerability.
2016/03/13 - Vendor acknowledgement about receipt.
2016/04/07 - Vendor confirms issue and schedules intended fixed
             version 6.40 for 2016/06/30.
2016/07/04 - Requested status update due to version 6.40 not being
             publicly available.
2016/07/05 - Vendor confirms a release delay. Schedules intended
             fixed version 6.40 for 2016/08/12.
2016/08/16 - Vendor confirms a further release delay. Schedules
             intended fixed version 6.40 for 2016/10/17.
2016/08/16 - Acknowledged delay and notified vendor that no further
             delay is acceptable due to disclosure policy and a
             Secunia Advisory will be released regardless of a fix
             being available or not.
2016/11/10 - Release of Secunia Advisory SA65535 and public
             disclosure of Secunia Research Advisory.
2016/12/23 - Update of SA65535 and the Secunia Research advisory due
             to a fixed version release.

======================================================================
6) Credits

Discovered by Dmitry Janushkevich, Secunia Research at Flexera
Software.

======================================================================
7) References

Currently no Common Vulnerabilities and Exposures (CVE) identifier is
assigned.

======================================================================
8) About Flexera Software

Flexera Software helps application producers and enterprises increase
application usage and the value they derive from their software.

http://www.flexerasoftware.com/enterprise/company/about/

Flexera Software  delivers  market-leading  Software  Vulnerability
Management solutions enabling enterprises to proactively identify and
remediate software vulnerabilities, effectively reducing the risk of
costly security breaches.

http://www.flexerasoftware.com/enterprise/products/

Flexera  Software  supports  and  contributes  to  the community in
several ways.  We have always believed that reliable vulnerability
intelligence and tools to aid identifying and fixing vulnerabilities
should be  freely available  for  consumers  to ensure that users,
who care about their online privacy and security, can stay secure.
Only a few vendors address vulnerabilities in a proper way and help
users get updated  and  stay secure.  End-users  (whether private
individuals or businesses)  are otherwise left largely alone,  and
that is why back in 2002,  Secunia Research started investigating,
coordinating  disclosure  and  verifying software vulnerabilities.
In  2016,  Secunia Research  became  a  part  of  Flexera Software
and today our in-house software vulnerability research remains the
core  of  the  Software  Vulnerability  Management  products  at
Flexera Software.

http://secunia.com/secunia_research/

The  public  Advisory database  contains sufficient information  for
researchers, security enthusiasts, and consumers to lookup individual
products and vulnerabilities  and  assess, whether they need to take
any actions to secure their systems or whether a given vulnerability
has already been discovered

http://secunia.com/advisories/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2016-15/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================