Title: Alienware Command Center 2.8.8.0 Local Privilege Escalation
Advisory ID: ZSL-2015-5229
Type: Local
Impact: Privilege Escalation
Risk: (2/5)
Release Date: 25.02.2015

Summary

Alienware Command Center is a software program developed by Alienware. The most common release is 2.8.8.0, with over 98% of all installations currently using this version. During setup, the program creates a startup registration point in Windows in order to automatically start when any user boots the PC. Upon being installed, the software adds a Windows Service which is designed to run continuously in the background. Manually stopping the service has been seen to cause the program to stop functing properly. It adds a background controller service that is set to automatically run. Delaying the start of this service is possible through the service manager. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). The primary executable is named AlienFusion.exe. The setup package generally installs about 99 files and is usually about 19.05 MB (19,979,162 bytes).

Description

The application suffers from an unquoted search path issue impacting the service 'ioloenergybooster' for Windows deployed as part of Alienware Command Center. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges of the application.

Vendor

Alienware Corporation - http://www.alienware.com

Affected Version

2.8.8.0

Tested On

Microsoft Windows 8

Vendor Status

N/A

PoC

alienware_eop.txt

Credits

Vulnerability discovered by Humberto Cabrera - <humbe@zeroscience.mk>

References

[1] http://packetstormsecurity.com/files/130530
[2] http://cxsecurity.com/issue/WLB-2015020134
[3] http://osvdb.org/show/osvdb/118809

Changelog

[25.02.2015] - Initial release
[26.02.2015] - Added reference [1] and [2]
[02.03.2015] - Added reference [3]

Contact

Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk