Zortam Mp3 Media Studio 21.15 Insecure File Permissions Privilege Escalation

vendor:

Zortam Mp3 Media Studio

by:

Tulpa

N/A

CVSS

HIGH

Insecure File Permissions Privilege Escalation

287

CWE

Product Name: Zortam Mp3 Media Studio

Affected Version From: 21.15

Affected Version To: 21.15

Patch Exists: NO

Related CWE:

CPE: a:zortam:mp3_media_studio:21.15

Metasploit:

Other Scripts:

Platforms Tested: Windows 10 Professional x64, Windows XP SP3 x86, Windows Server 2008 R2 x64

2016

Zortam Mp3 Media Studio 21.15 Insecure File Permissions Privilege Escalation

Zortam Mp3 Media Studio installs with weak file permissions, allowing any user full permission to the exe. This allows for code execution against any other user running the application.

Mitigation:

The vendor should update the file permissions to restrict access to the exe.

Source

Exploit-DB raw data:

# Exploit Title: Zortam Mp3 Media Studio 21.15 Insecure File Permissions Privilege Escalation
# Date: 23/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: http://www.zortam.com/
# Software Link: http://www.zortam.com/download.html
# Version: Software Version 21.15
# Tested on: Windows 10 Professional x64, Windows XP SP3 x86, Windows Server 2008 R2 x64
# Shout-out to carbonated and ozzie_offsec

1. Description:

Zortam Mp3 Media Studio installs by default to "C:\Program Files (x86)\Zortam Mp3 Media Studio\zmmspro.exe" with very weak file permissions granting any user full permission to the exe. This allows opportunity for code execution against any other user running the application.

2. Proof

C:\Program Files\Zortam Mp3 Media Studio>cacls zmmspro.exe
C:\Program Files\Zortam Mp3 Media Studio\zmmspro.exe BUILTIN\Users:F
                                                     NT AUTHORITY\SYSTEM:(ID)F
                                                     BUILTIN\Administrators:(ID)F
                                                     BUILTIN\Users:(ID)R


3. Exploit:

Simply replace zmmspro.exe and wait for execution.