----------------------------------------------------------------------

Want to work within IT-Security?

Secunia is expanding its team of highly skilled security experts.
We will help with relocation and obtaining a work permit.

Currently the following type of positions are available:
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
PassGo Defender Insecure Default Directory Permissions

SECUNIA ADVISORY ID:
SA22271

VERIFY ADVISORY:
http://secunia.com/advisories/22271/

CRITICAL:
Less critical

IMPACT:
Manipulation of data, Privilege escalation

WHERE:
Local system

SOFTWARE:
PassGo Defender 5.x
http://secunia.com/product/12349/

DESCRIPTION:
nnposter has reported a security issue in Passgo Defender, which can
be exploited by malicious, local users to gain escalated privileges.

The security issue is caused due to setting insecure permissions to
the application directory (grants "Everyone" group "Full Control")
and child objects. This can be exploited to manipulate the
application's files.

The security issue is reported in version 5.2. Other versions may
also be affected.

SOLUTION:
According to the vendor, the security issue has been fixed in the
latest patch level.

PROVIDED AND/OR DISCOVERED BY:
nnposter

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------