Dear List, YARAS, Yet Another Rogue Autostart.... Below you find the mail I send to Parallel on the 23 of Septembre. unlike stated in the text, rogue autostart also happens when installing the application. No priviledge escalation so far so the issue is no biggie. Still I would have liked a reaction form the vendor. Anyways, Parallel did not care to reply and did not fix the "bug". I decided to post this here for everybody to know. -- http://secdev.zoller.lu Thierry Zoller ===8<=================== Original Nachrichtentext =================== Dear Parallels Team, I came across a small sec. issue during uninstallation of your program. (See that screenshots attached) The program PRLDHCP is shelled without the usage of QUOTES in the path, leading to the execution of c:\program.exe (without elevation of priviledges) That said it is only an issue as an auto start vector. This might be a Macrovision issue but I don't think so. -- http://secdev.zoller.lu Thierry Zoller ===8<============== Ende des Original Nachrichtentextes =============
Attachment:
Paralells_macrovision2.png
Description: PNG image
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
