JIMS: Local Privilege Escalation vulnerability via repair functionality
An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service (JIMS) allows an unprivileged user to trigger a repair operation. Running a repair operation, in turn, will trigger a number of file operations in the %TEMP% folder of the user triggering the repair. Some of these operations will be performed from a SYSTEM context (started via the Windows Installer service), including the execution of temporary files. An attacker may be able to provide malicious binaries to the Windows Installer, which will be executed with high privilege, leading to a local privilege escalation. This issue affects Juniper Networks Juniper Identity Management Service (JIMS) versions prior to 1.4.0.
The following software releases have been updated to disable the "repair" function of the Windows installer, resolving this specific issue: JIMS 1.4.0, and all subsequent releases.
Configurations
Workarounds
There are no viable workarounds for this issue.
Exploits
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Credits
Juniper SIRT would like to acknowledge and thank Ronnie Salomonsen from Mandiant for responsibly reporting this vulnerability.