Vulnerabilities > CVE-2005-2711 - Local Privilege Escalation vulnerability in Internet Security Systems BlackICE and RealSecure Desktop
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
ISS BlackIce 3.6, as used in multiple products including BlackICE PC Protection, Server Protection, Agent for Server, and RealSecure Desktop 3.6 and 7.0, does not drop privileges before launching help from the "More Info" button in the "Application Protection" dialog, which allows local users to execute arbitrary programs as SYSTEM.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 6 |
References
- http://secunia.com/advisories/19327
- http://securitytracker.com/id?1015820
- http://securitytracker.com/id?1015821
- http://www.idefense.com/intelligence/vulnerabilities/display.php?id=403
- http://www.osvdb.org/24096
- http://www.securityfocus.com/bid/17218
- http://www.vupen.com/english/advisories/2006/1090
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25423