CVE-2005-2711 ISS BlackIce 3.6, as used in multiple products including BlackICE PC Protection, Server Protection, Agent for Server, and RealSecure Desktop 3.6 and 7.0, does not drop privileges before launching help...
HighCVSS 7.2
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ISS BlackIce 3.6, as used in multiple products including BlackICE PC Protection, Server Protection, Agent for Server, and RealSecure Desktop 3.6 and 7.0, does not drop privileges before launching help from the "More Info" button in the "Application Protection" dialog, which allows local users to execute arbitrary programs as SYSTEM.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| iss blackice agent server | All versions | No fix listed |
| iss blackice pc protection | = 3.6 | No fix listed |
| iss blackice pc protection | = 3.6cpu | No fix listed |
| iss blackice server protection | All versions | No fix listed |
| iss realsecure desktop | = 3.6 | No fix listed |
| iss realsecure desktop | = 7.0 | No fix listed |
References
- 19327 third-party-advisory
- 1015820 vdb-entry
- 1015821 vdb-entry
- 20060323 ISS Multiple Products Local Privilege Escalation Vulnerability third-party-advisory vendor-advisory
- 24096 vdb-entry
- 17218 vdb-entry
- ADV-2006-1090 vdb-entry
- blackice-appprotection-privilege-escalation(25423) vdb-entry