1.14.2

CHANGELOG.md

@@ -3,6 +3,15 @@ All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
 
+
+
+## [1.14.2 / 5.69.2] - 2024-06-??
+
+### Fixed
+- fixed security issue with the newly introduced experimental "UseCreateToken=y" machanism
+
+
+
 ## [1.14.1 / 5.69.1] - 2024-06-06
 
 ### Added

Sandboxie/common/my_version.h

@@ -26,7 +26,7 @@
 
 #define VERSION_MJR		5
 #define VERSION_MIN 	69
-#define VERSION_REV 	1
+#define VERSION_REV 	2
 #define VERSION_UPD 	0
 
 #if VERSION_UPD > 0

Sandboxie/core/drv/token.c

@@ -2259,15 +2259,18 @@ _FX void* Token_CreateToken(void* TokenObject, PROCESS* proc)
                     continue;
                 }
 
-                if (KeepLogonSession && (LocalGroups->Groups[i].Attributes & SE_GROUP_LOGON_ID))
-                    continue;
+				if ((LocalGroups->Groups[i].Attributes & SE_GROUP_LOGON_ID)) {
+					if(!KeepLogonSession)
+						LocalGroups->Groups[i].Attributes = SE_GROUP_LOGON_ID | SE_GROUP_USE_FOR_DENY_ONLY;
+					continue;
+				}
 
                 if (RtlEqualSid(LocalGroups->Groups[i].Sid, LocalUser->User.Sid)) {
                     if (KeepUserGroup)
                         continue;
                 }
 
-                LocalGroups->Groups[i].Attributes = 0;
+                LocalGroups->Groups[i].Attributes = SE_GROUP_USE_FOR_DENY_ONLY;
             }
         }
 

SandboxiePlus/version.h

@@ -2,7 +2,7 @@
 
 #define VERSION_MJR		1
 #define VERSION_MIN 	14
-#define VERSION_REV 	1
+#define VERSION_REV 	2
 #define VERSION_UPD 	0
 
 #ifndef STR