Bugtraq mailing list archives
Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execution and escalation of privilege
From: "Stefan Kanthak" <stefan.kanthak () nexgo de>
Date: Wed, 23 Dec 2015 13:13:56 +0100
Hi @ll, F-Secure's online virus scanner F-SecureOnlineScanner.exe, available via <https://www.f-secure.com/en/web/home_global/online-scanner>, loads and executes several rogue/bogus DLLs (UXTheme.dll, HNetCfg.dll, RASAdHlp.dll, SetupAPI.dll, ClbCatQ.dll, XPSP2Res.dll, CryptNet.dll, OLEAcc.dll etc.) eventually found in the directory it is started from (the "application directory"). For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see <https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html>, <http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html> and <http://seclists.org/fulldisclosure/2012/Aug/134> Due to the application manifest embedded in the executable which specifies "requireAdministrator" the installer is started with administrative privileges ("protected" administrators are prompted for consent, unprivileged standard users are prompted for an administrator password); execution of any hijacked DLL results in an escalation of privilege! See <http://seclists.org/fulldisclosure/2015/Nov/101> and <http://seclists.org/fulldisclosure/2015/Dec/86> plus <http://home.arcor.de/skanthak/sentinel.html> and the still unfinished <http://home.arcor.de/skanthak/!execute.html> for more details and why executable installers (and self-extractors too) are bad. F-Secure published a security advisory <https://www.f-secure.com/en/web/labs_global/fsc-2015-4> and made an updated version of their online scanner available on <https://www.f-secure.com/en/web/home_global/online-scanner> CAVEAT: F-Secure's fix works only on Windows Vista and newer versions; the vulnerability is still present on earlier versions of Windows! stay tuned Stefan Kanthak
Current thread:
- Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execution and escalation of privilege Stefan Kanthak (Dec 23)