Florian Bogner

Name of the Vulnerable Software and Affected Versions: Securepoint SSL VPN Client versions prior to 2.0.32 Description: The issue concerns unsafe configuration handling that enables local privilege escalation to NT AUTHORITYSYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%Securepoint SSL VPN" and add an external script file that is executed as a privileged user. Recommendations: For versions prior to 2.0.32, update to version 2.0.32 or later to resolve the issue. As a temporary workaround, consider restricting access to the OpenVPN configuration stored under "%APPDATA%Securepoint SSL VPN" to prevent non-privileged users from modifying it. Additionally, avoid using external script files in the OpenVPN configuration until the issue is resolved.

The issue is related to an uncontrolled DLL search path, allowing a malicious local user to elevate to SYSTEM privileges. This occurs when the Python interpreter attempts to load python3.dll from a writable location, specifically "C:DLLspython3.dll".

The issue allows remote attackers to execute arbitrary SQL commands via the `username` field in the login form.

The issue is related to an information leak. An attacker with system login capabilities can exploit this to copy the user's proxy password, resulting in information leaks.

The issue concerns the use of insecure HTTP for software package downloads and the lack of integrity checks on the downloaded packages. This allows an attacker to potentially launch a Man-In-The-Middle (MITM) attack, interrupting or replacing the software package, which could further compromise the PC.

The issue is related to a dynamic link library (DLL) hijack, where an attacker can make the system load malicious DLL files to execute arbitrary code.