Last Modified: Oct. 18, 2016
ZAK in Appstation mode allows users to bypass the "Run only allowed apps" policy by starting Explorer from Office 97 applications (such as Word), installing software into the TEMP directory, and changing the name to that for an allowed application, such as Winword.exe.
Access Vector: Local
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: Partial
Availability Impact: Partial
Base Score: 4.6
Exploitability Score: 3.9
Impact Score: 6.4
CVSS V2: AV:L/AC:L/Au:N/C:P/I:P/A:P
NVD-CWE-Other
| Condition | Configuration | |
|---|---|---|
| OR | ||
| OR | ||
| cpe:2.3:a:microsoft:zero_administration_kit:1.0:*:*:*:*:*:*:* Part: a Vendor: microsoft | Alle Schwachstellen für microsoft | |
<?xml version="1.0" ?>
<set operator="and">
<set operator="or">
<prop key="application" value="cpe:2.3:a:microsoft:zero_administration_kit:1.0:*:*:*:*:*:*:*"/>
</set>
<prop key="program_influence" value="input"/>
<prop key="range" value="local"/>
</set>
<?xml version="1.0" ?>
<set operator="and">
<prop key="target" value="host"/>
<set operator="or">
<prop key="program_influence" value="input"/>
<prop key="program_influence" value="output"/>
<prop key="program_influence" value="existence"/>
</set>
<prop key="data" value="any"/>
<set operator="or">
<prop key="data_influence" value="read"/>
<prop key="data_influence" value="write"/>
<prop key="data_influence" value="delete"/>
</set>
<set operator="or">
<prop key="range" value="local"/>
<prop key="range" value="local"/>
</set>
</set>