Juniper VPN client with remote desktop lets an attacking spawn Internet Explorer prior to authentication.
f6891045a7207af4d1a8fb5787e4acbee0b1a68022babe3bae8c08623c705fa7
Juniper VPN client rdesktop clickhack
================================
discovered by niekt0@hysteria.sk
PRODUCT: Juniper VPN client + Windows remote desktop (or console access)
VERSION AFFECTED: Win Vista/7 + Juniper VPN client (all versions)
EXPOSURE: Remote code execution (SYSTEM privileges)
SYNOPSIS
========
By simple clicking it is possible to spawn a
Internet Explorer instance on rdesktop session
before authentication.
Account on target server is not required.
PROOF OF CONCEPT
================
If small blue icon "network logon" is available in right down corner,
system may be vulnerable (windows vista & 7).
Click on the icon and keep clicking like a real power user until
you get your explorer.
Probably at least one VPN or Dial-UP connection must be defined.
Illustrated guide is available at
https://hysteria.sk/~niekt0/advisory/rdesktop_fun/
WORKAROUND
==========
None known.
VENDOR RESPONSE
===============
Not contacted. (try calling "helpdesk")
NOTICE
======
It is not really clear, if this is only juniper issue.
After third click, ale spawned screens are legitimate windows menu.
According to some guides it should be possible to create
"network logon" icon just by setting Windows. However,
I was not able to do so, at least not in Windows 7 ultimate.
Thanks to #brmlab, biiter