0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
WPS Office 10.2.0.5978 - NULL DACL grants full access Vulnerability
[=====[ Tempest Security Intelligence - ADV-16/2018 ]=== WPS Free Office 10.2.0.5978 - NULL DACL grants full access ------------------------------------------------------- Author: - Filipe Xavier Oliveira: < filipe.xavier () tempest.com.br =====[ Table of Contents ]===================================================== * Overview * Detailed description * Timeline of disclosure * Thanks & Acknowledgements * References =====[ Overview ]============================================================== * System affected : KingSoft WPS Free Office [1] * Software Version : 10.2.0.5978. Other versions or models may also be affected. * Impact : A low privileged user can access and modify the DACL of pipe with full access allowed. The NULL DACL grants full access to any user that requests it; normal security checking is not performed with respect to the object. =====[ Detailed description ]================================================== Kingsoft WPS Office Free 10.2.0.5978 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of \\.\pipe\WPSCloudSvr\WpsCloudSvr -- an "insecurely created named pipe." Ensures full access to Everyone users group. =====[ Timeline of disclosure ]=============================================== 29/01/2018 - Vendor was informed of the vulnerability. 01/29/2018 - CVE assigned [2] 02/05/2018 - Tried to contact vendor again. 03/06/2018 - Advisory publication date. =====[ Thanks & Acknowledgements ]============================================ - Tempest Security Intelligence / Tempest's Pentest Team [3] =====[ References ]=========================================================== [1] - http://www.kingsoftstore.com/ [2] - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6400 [3] - http://www.tempest.com.br -- Filipe Oliveira Tempest Security Intelligence # 0day.today [2024-11-15] #