CheckPoint VPN-1 SecureClient - CheckQuotes
As employees become more mobile, sophisticated VPN solutions are required to meet key security challenges such as securing access to corporate resources and protecting remote desktops. To meet the VPN client needs of any organization, Check Point offers VPN-1 SecureClient.
Title : CheckPoint - CheckQuotes!
Ref : TZO-012006-Checkpoint
During Startup, the SR_Watchdog.exe spawns the GUI process (SR_GUI.exe) through the use of the CreateProcess() function. By doing so it omits to set the 'lpApplicationName' variable and further omits to quote the path in the variable "lpCommandLine". Ref 
This results in c:\program.bat|exe|com being called prior to Sr_GUI.exe
and allows automatic startup of a potentially rogue application. In
particular one could imagine a scenario where it is possible to escalate
rights using this (as they are inherited from SR_Watchdog.exe).
I decided that this is not worth to report to the vendor, I consider this
low impact in terms of Security. (Although it might show bad coding
 Only a real issue in Windows 2000, WinXP restricted users don't have the right to write to c:\
The views and opinion expressed herein are my personal views and are not intended to reflect the views of my employer or any other entity.