Security Advisory: UpSlide Reactivation Service v6.5.9.0

Avatar
Written by Jérôme | Updated
Advisory ID: UPS-2020-001
CVSSv3.1 Range: 6.5 (Medium)
Issue Date: 2020-10-01
Updated On: 2020-10-01 (Initial Advisory)
Synopsis: Permissive rights on UpSlide Monitoring Service could lead to potential code execution

Advisory details

Impacted Products

UpSlide Add-In: Version 6.5.9.0 to 6.6.9.0

Introduction

To ensure that UpSlide is always enabled on Office applications, a Windows Service (UpSlideMonitoring) is deployed on end-user computers during UpSlide installation. It has been discovered that the service's binary is stored in a folder that has permissive access rights. An update has been addressed to fix the issue.

Description

The UpSlide reactivation service is currently located under a folder that has permissive access rights. This service could be replaced by another executable without needing administrator rights on the computer.

Known Attack Vectors

Successful exploitation of this issue may allow an attacker to gain privileged access to the computer running code as a Windows Service.

Note
To exploit this issue, the attacker needs to have local access and a logged-in session to the computer running UpSlide.

Resolution

To fix the issue, the reactivation service should be moved to another folder with restricted rights. This can be achieved in two ways:

1. The existing reactivation service can be moved to a restricted folder via using a script that impacted clients have received

2. A new UpSlide installer could be generated and provided to you for deployment

  • This installer removes the previous service and installs a new version of the service on a separate folder than the UpSlide installation folder.
  • This folder will have restricted access.

Either option will achieve the same outcome. We recommend you start (1) immediately and wait for us to contact you for (2). We are systematically processing through our affected clients. Contact your account owner if you would like a status update on your specific package. 

Fix introduced in

UpSlide Add-In: Version 6.6.10.3

Change Log

2020-10-01 UPS-2020-001: Initial Security Advisory

2020-10-02 UPS-2020-001: Details added

Contact

If you have any questions regarding this vulnerability, please contact UpSlide support via email: support@upslide.net

If you want to report a vulnerability on UpSlide products please contact security@upslide.net