Posted by Mark Wadham on Apr 11

Proxifier 2.18 (also 2.17 and possibly some earlier version) ships with
a KLoader binary which it installs suid root the first time Proxifier is
run. This binary serves a single purpose which is to load and unload
Proxifier’s kernel extension.

Unfortunately it does this by taking the first parameter passed to it on
the commandline without any sanitisation and feeding it straight into
system().

This means not only can you load any…