Title: HM Software S to Infinity Multiple Vulnerabilities
Severity: LOW
Description:
A number of vulnerabilities exist in HM Software S to Infinity, a security access control, desktop lockdown and transparent encryption application. Intended features include restriction of access to folders, files, floppy and CD-ROM drives, etc.
Early versions of S to Infinity allows the capability of any user to rename files and directories which opens up the possibility of a number of exploits:
- Renaming the S to Infinity directories in /Program Files and /Winnt/System will cause the program to cease to function.
- S to Infinity implicitly trusts any allowed program on the system. However, it can be configured to set *.exe to read-only. Therefore, a user can run any application by copying the executable program to something.txt and then renaming that copy to a trusted executable like notepad.exe.
Other security flaws present in S to Infinity:
- The drive invisibility mechanism can be bypassed by using Find, Internet Explorer, or Open and Save Dialogue boxes. Searching for the hidden drive letter and a known file in Find will allow access to files on the hidden drive. A user can open a hidden drive in Internet Explorer by clicking on a link that refers to the particular drive (eg. <a href="c:\">Link</a>).
- File and directory attributes can be modified using the DOS attrib command. StoI file-level protection does not rely on DOS file attributes, so this will not affect StoI settings.
Affected Products:
- HM Software S to Infinity 3.0.0
References:
- HM Software: S to Infinity Product Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
