lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 16 Nov 2018 10:31:31 +0100
From: "Stefan Kanthak" <>
To: <>
Cc: <>
Subject: [CVE-2018-3635] Executable installers are vulnerable^WEVIL (case 59): arbitrary code execution WITH escalation of privilege via Intel Rapid Storage Technology User Interface and Driver

Hi @ll,

the executable installer of the
IntelĀ® Rapid Storage Technology (IntelĀ® RST) User Interface and Driver,
version (LATEST for Windows 7), released 11/14/2017, available
from <> via
is (SURPRISE!) vulnerable!

CVSS score: 7.5/HIGH    CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

See Intel's security advisory SA-00153

Vulnerability #1:

Although running with ELEVATED (administrative) privileges
(the "application manifest" embedded in SetupRST.exe specifies
"requireAdministrator"), on STANDARD installations of Windows,
i.e. where the user account created during Windows setup is used,
the executable installer creates an UNPROTECTED subdirectory
IIF<abcd>.tmp in the user's %TEMP% directory.

For this well-known and well-documented vulnerability see
<> and
<> plus

The subdirectory IIF<abcd>.tmp inherits the NTFS ACLs from its
parent %TEMP%, allowing "full access" for the unprivileged
(owning) user, who can replace/overwrite the DLLs


later loaded and executed by the installer between their creation
and use.
Since these DLLs are executed with administrative privileges, this
vulnerability results in arbitrary code execution WITH escalation
of privilege.

NOTE: the precondition "user account created during Windows setup"
      is met on typical installations of Windows: according to
      Microsoft's own security intelligence reports, about 1/2 to
      3/4 of the about 600 million Windows installations which send
      telemetry data have only ONE active user account.

Demonstration/proof of concept:

1. visit <>,
   then download
   and save it in an arbitrary directory;

2. save the following batch script in the same directory:

   --- IIF.CMD ---
   @If Not Exist "%TEMP%\IIF????.tmp" Goto :WAIT
   For /D %%! In ("%TEMP%\IIF????.tmp") Do Set IIFTMP=%%!
   Copy /Y SENTINEL.DLL "%IIFTMP%\Resource.dll"
   For /R "%IIFTMP%" %%! In (IntelCommon.dll) Do Copy /Y SENTINEL.DLL "%%!"
   Set IIFTMP=
   --- EOF ---

3. start the batch script per double-click;

4. execute SetupRST.exe: notice the message boxes displayed from
   the replaced DLLs.


1. ALWAYS specify a PROPER "security descriptor" when you create
   (temporary) files or directories in potentially unsafe (i.e.
   user-writable) paths like the %TEMP% directory!
   See <>
   and use the second parameter of CreateDirectory() to properly
   restrict the permissions when running elevated!

2. NEVER load resource(-only) DLLs for execution!
   See <>
   and use the third parameter of LoadLibraryEx() to specify


1. DONT use executable installers; stay far away from such
   eternally vulnerable crap!

2. NEVER run executable installers in unsafe environments,
   especially NEVER from UNSAFE directories like "%TEMP%\" or

3. DISABLE execution of files (via NTFS ACL, as shown below) in
   the systems and every users %TEMP% and every %USERPROFILE%
   (see <>)!

4. Practice STRICT privilege separation: use a your privileged
   "Administrator" account (especially the account created during
   Windows setup) ONLY for administrative tasks, and COMPLETELY
   separate unprivileged user accounts, with elevation requests
   DISABLED, for your everyday/regular work.

Vulnerability #2:

A variant of #1, resulting in denial of service.

Demonstration/proof of concept:

1. add the NTFS access control list entry (D;OIIO;WP;;;WD) meaning
   "deny execution of files in this directory for everyone,
   inheritable to all subdirectories" to the (user's) %TEMP%

   NOTE: this does NOT need administrative privileges!

2. execute SetupRST.exe: notice the message box
   "error loading language resource" displayed.


Create (temporary) files and directories with PROPER permissions!
See above.

stay tuned
Stefan Kanthak


2018-06-06    vulnerability report sent to vendor

2018-06-10    Intel acknowledges receipt

2018-06-14    Intel confirms reported vulnerability

2018-10-26    CVE-2018-3635 assigned

2018-11-13    Intel publishes security advisory SA-00153

2018-11-16    vulnerability report published

Powered by blists - more mailing lists