Full Disclosure mailing list archives
nProtect solutions arbitrary file download and execute vulnerability
From: Park Gyutae <saintlinu () yahoo co kr>
Date: Fri, 29 Jul 2005 13:22:54 +0900 (JST)
-------------------------------------------------------------------------------------------------------- Title: nProtect:Netizen arbitrary file download and execute vulnerability nProtectPersonal Web Service arbitrary file download and execute vulnerability Discoverer: PARK, GYU TAE (saintlinu () null2root org) Neo Advisory No.: NRVA05-04 NRVA05-05 Critical: High critical Impact: Gain remote user's privilige Where: From remote Operating System: Windows Only Solution: Patched Notice: 07. 01. 2005 initiate notify 07. 04. 2005 Second notify 07. 26. 2005 Patched 07. 29. 2005 Disclosure vulnerability Description: The nProtect:Netizen and nProtectPersonal Web Service are an antivirus solutions. It defends user from Internet about well-known hack tools and viruses something When it need update and patch itself then download from web site such as update.nprotect.net that time nProtect update program, npdownv.exe, DO NOT CHECK THAT update site URL!!! We can change URL, update configuration file and so on But npdownv.exe DO CHECK files that downloaded from update site compressed WITH PASSWORD!!! this means npdownv.exe already known password for decompress I found password in npdownv.exe by REVERSE ENGINEEGERING and Neo modified liveup.haz, configuration file When user accees the phishing page then downloaded trojan from hacker URL See following detail describe: EXPLOIT NOT INCLUDED HERE Related link: http://www.nprotect.co.kr/service/nProtectPersonal/nprotect/npos/kor/personal_npos.html -------------------------------------------------------------------------------------------------------- Special thanks for My best group Null@root. PS. I'm very sorry for poor my konglish __________________________________________________ 두 유 야후!? 스팸때문에 짜증나세요? 야후! 메일의 스팸 차단 기술로 메일을 보호합니다 http://mail.yahoo.co.kr
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- nProtect solutions arbitrary file download and execute vulnerability Park Gyutae (Jul 28)