|Title||iPass Mobile Client service local privilege escalation|
|Product||iPass Mobile Client|
|Affected versions||iPass Mobile Client 18.104.22.16822 (Newer version might be also affected)|
|By||Hans-Martin Muench (Mogwai, IT-Sicherheitsberatung Muench)|
The iPass Open Mobile client for laptops is lightweight and always on. It provides easy, seamless connectivity across iPass, customer, and third-party networks, and allows you to mix and match carrier networks without disrupting your users.
The iPass Open Mobile client for laptops allows organizations to provide granular options for how employees connect to iPass Wi-Fi (the iPass Mobile Network), campus Wi-Fi, mobile broadband (3G/4G), Ethernet, and dial, using a single platform to manage all connections. Open Mobile also enables cost and security controls that provide virtual private network (VPN) integration options; mobile broadband 3G/4G usage controls for both data roaming and data usage; endpoint integrity verification that checks the security of the device at the point of connection; and several additional options for setting network connection and restriction policies. Insight into an organizations mobility usage is provided through user and device activity and summary reports as well as mobile broadband usage reports.
"We do not consider this a vulnerability as it is how the product was designed"
Disable the iPass service unless really required
|CVSS Base Score||5.6|
|CVSS v2 Vector||(AV:L/AC:L/Au:N/C:P/I:C/A:N)|
The iPass Open Mobile Windows Client utilizes named pipes for interprocess communication. One of these pipes accepts/forwards commands to the iPass plugin subsystem.
A normal user can communicate with this pipe through the command line client EPCmd.exe which is part of the iPass suite. A list of available commands can be displayed via "System.ListAllCommands".
The iPass pipe provides a "iPass.EventsAction.LaunchAppSysMode" command which allows to execute arbitrary commands as SYSTEM. This can be abused by a normal user to escalate his local privileges.
Please note that this issue can also be exploited remotely in version 22.214.171.12422 as the named pipe can also be called via SMB. However according to our information, the pipe is no longer remotely accessible in current versions of the iPass Mobile client.
The following EPCmd command line creates a local user "mogwai" with password "mogwai":
EPCmd.exe iPass.EventsAction.LaunchAppSysMode c:\windows\system32\cmd.exe;"/c net user mogwai mogwai /ADD;;
|10/03/2015||Requesting security contact from iPass sales|
|10/03/2015||Sales responded, will forward vulnerability information to the development|
|11/03/2015||Sending vulnerability details|
|11/03/2015||iPass asks which customer we represent|
|11/03/2015||Responding that we don't represent any iPass customer|
|12/03/2015||iPass responded, wont fix, says that the product works as designed|
Advisory URL: https://www.mogwaisecurity.de/#lab
Mogwai, IT-Sicherheitsberatung Muench
89075 Ulm (Germany)