Privilege Escalation Vulnerability in the iba Install Agent

Summary

If you install the following application as a regular user without administrative privileges, you will be prompted to provide admin rights during the installation. After the installation, you can select a checkbox to start the application immediately. At this point, the permissions are not properly reverted, which means the application runs with elevated privileges, resulting in a privilege escalation.
This can be exploited after the installation and automatic start of the application via the installer option. For example, you can open a command‑line interface that runs in the same user context as the iba application in this case with administrator privileges, because these privileges were not correctly reverted after the installation.

Example (ibaVision):
After the installation, I can use the “Open ibaVision configuration” option to navigate to C:\Windows\System32\cmd.exe and start the command prompt with the same privileges that ibaVision currently has — in this case administrator privileges, because they were not correctly reverted after the installation.

After signing out and signing back in to the Windows user account, the elevated privileges are lost and the application runs with normal user permissions again.

Affected products

This applies to all iba products up to the versions listed below:

• ibaCMC v3.5.1
• ibaCapture v5.5.2
• ibaVision v3.1.1
• ibaAnalyzer v8.3.4
• ibaDatCoordinator v4.0.3
• ibaHD-Server v3.5.2

How do I know that I’m affected?

If you have installed any of the products listed above, you are affected.

Mitigation

Restart your system after installing the iba software.

Solution

With the following versions, the issue has been fixed in the installer:

• ibaCMC v3.6.0
• ibaCapture v5.5.3
• ibaVision v3.1.2
• ibaAnalyzer v8.3.5
• ibaDatCoordinator v4.0.4
• ibaHD-Server v3.6.0

Customer Actions

Please install the update as described in the solution

Timeline