Check Point released a security update to fix a vulnerability in its antivirus and firewall ZoneAlarm, the flaw could be exploited by attackers to escalate privileges on a system running it.
The flaw was discovered last year by security firm
OwnDigo because the original name for the WCF was “Indigo”.
“This vulnerability allows a low-privileged user to escalate privileges to SYSTEM-level with the anti-virus software enabled. The vulnerability is due to
“The affected .NET service is running with SYSTEM-level privileges; therefore, injected code is run at the SYSTEM-level, bypassing privilege restrictions and allowing the user to gain full control of the system.”
Experts at Illumant’s started their analysis with previous research made by Fabius Artrel on privilege escalation and code execution flaws in applications that use
The flaw could allow an attacker with limited access to the targeted device to execute arbitrary commands with SYSTEM privileges. The
Experts noticed that any code could be executed on the target system only if they appear to be signed by Check Point, then they forged a fake
Check Point code-signing certificate for a user with limited privileges and installed it on the targeted system. The certificate was then used to sign the exploit and payload code, which could then be executed to elevate privileges.
Check Point addressed the flaw in October with the release of ZoneAlarm version 15.4.062.17802.
(SecurityAffairs – ZoneAlarm, hacking)