Secunia

Reed Arvin has discovered a vulnerability in Linksys WLAN Monitor, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to the program running its GUI with SYSTEM privileges rather than using the privilege of the currently logged on user. This can be exploited gain SYSTEM privileges by invoking the program from the system tray and then using its profile import file open dialog box to launch cmd.exe.

The vulnerability has been confirmed in version 2.0. Other versions may also be affected.

Solution
Grant only trusted users access to affected systems.

Provided and/or discovered by
Reed Arvin

Original Advisory
http://reedarvin.thearvins.com/20050810-01.html

Deep Links
Links available in Customer Area