Dennis P. Nikolaenko has discovered a security issue in TeamViewer, which can be exploited by malicious, local users to gain escalated privileges.

The security issue is caused due to the application setting insecure file system permissions to the application's installation directory. This can be exploited to overwrite any program or library in the "Version6" directory.

Successful exploitation allows execution of arbitrary code with escalated privileges when e.g. an administrative user launches the desktop application, but requires the "Remote Access" functionality to be enabled during installation (disabled by default).

The security issue is confirmed in version 6.0.10194 running on Windows 7. Other versions may also be affected. The installation on a Windows XP system is not affected.

Solution
Update to version 6.0.10344.

Provided and/or discovered by
Dennis P. Nikolaenko via Secunia.

Deep Links
Links available to Secunia VIM customers