Full Disclosure mailing list archives
Executable installers are vulnerable^WEVIL (case 32): Comodo's installers allow arbitrary (remote) code execution WITH escalation of privilege
From: "Stefan Kanthak" <stefan.kanthak () nexgo de>
Date: Tue, 22 Mar 2016 23:31:42 +0100
Hi @ll, the executable installers cispro_30day_installer_1150_8d.exe, cispremium_installer_6100_08.exe, cav_installer_5951_60.exe, cav_installer.exe and cfw_installer.exe available from <http://www.comodo.com> load and execute several DLLs from their "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see <https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html>, <http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html> and <http://seclists.org/fulldisclosure/2012/Aug/134> If an attacker places one of these DLLs in the users "Downloads" directory (for example per drive-by download or social engineering) this vulnerability becomes a remote code execution. Due to the application manifest embedded in the executables which specifies "requireAdministrator" the executable installer is run with administrative privileges ("protected" administrators are prompted for consent, unprivileged standard users are prompted for an administrator password); execution of the DLLs therefore results in an escalation of privilege! Proof of concept/demonstration: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1. visit <http://home.arcor.de/skanthak/sentinel.html>, download <http://home.arcor.de/skanthak/download/SENTINEL.DLL> and save it as UXTheme.dll in your "Downloads" directory, then copy it as DWMAPI.dll, RichEd20.dll, ClbCatQ.dll and ProfAPI.dll; 2. download any of the executable installers provided by Comodo and save them in your "Downloads" directory; 3. run the executable installers from the "Downloads" directory; 4. notice the message boxes displayed from the DLLs placed in step 1. PWNED! See <http://seclists.org/fulldisclosure/2015/Nov/101> and <http://seclists.org/fulldisclosure/2015/Dec/86> as well as <http://home.arcor.de/skanthak/!execute.html> and <http://home.arcor.de/skanthak/sentinel.html> for details about this well-known and well-documented BEGINNER'S error! stay tuned Stefan Kanthak PS: I really LOVE (security) software with such trivial beginner's errors. It's a tell-tale sign to better stay away from it! Timeline: ~~~~~~~~~ 2016-01-21 sent report to vendor NO ANSWER, not even an acknowledgement of receipt 2016-01-28 resent report to vendor 2016-01-28 Vendor acknowledges receipt 2016-02-29 Vendor informs: "update ready, schedule for release during the week of March 14" 2016-03-22 Vendor releases updates; see the release notes <https://cdn.download.comodo.com/cis/download/installs/updates/release/inis_4055/release_notes.html> _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Executable installers are vulnerable^WEVIL (case 32): Comodo's installers allow arbitrary (remote) code execution WITH escalation of privilege Stefan Kanthak (Mar 23)