Vulnerability Note: VU#760767: Macrium Reflect is vulnerable to privilege escalation due to OPENSSLDIR location
Macrium Reflect contains a privilege escalation vulnerability due to the use of an
OPENSSLDIR variable that specifies a location where an unprivileged Windows user can create files.
Macrium Reflect includes an OpenSSL component that specifies an
OPENSSLDIR variable as
C:openssl. Macrium Reflect contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted
openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.
By placing a specially-crafted
openssl.cnf in the
C:openssl directory, an unprivileged user may be able to execute arbitrary code with SYSTEM privileges on a Windows system with the vulnerable Macrium software installed.
Apply an update
This vulnerability is addressed in Macrium Reflect v7.3.5281.
This vulnerability was reported by Will Dormann of the CERT/CC.
This document was written by Will Dormann.