lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4295B803.3070500@gmail.com>
Date: Thu May 26 17:42:57 2005
From: bania.piotr at gmail.com (Piotr Bania)
Subject: Alwil Software Avast Antivirus Device Driver
	Memory Overwrite Vulnerability



Alwil Software Avast Antivirus Device Driver Memory Overwrite
Vulnerability
by Piotr Bania <bania.piotr@...il.com>
http://pb.specialised.info

Original location: 	http://pb.specialised.info/all/adv/avast-adv.txt


Severity: 	   Less Critical/Medium - local ring0 code execution

Software affected: Probably all versions of Avast Antivirus,
		   however tested with 4.6v. I have contacted
		   Alwil Software and the bug is patched within
		   the new version (released few days ago).


I.  BACKGROUND

Avast Antivirus is very common antivirus software package with a big
worldwide userbase. (more details on: http://www.avast.com)


II. DESCRIPTION

The vulnerability is caused by no bounds checking procedure in the
device driver.  By sending special signal(s) together with specially
crafted input buffer attacker can force Avast Asynchronous Virus Monitor 
to overwrite specified memory with data provided by the attacker.


Here is the one of vulnerable codes:
(DISASSEMBLY OF Aavmker4 DEVICE DRIVER)

----// SNIP SNIP //-------------------------------------------------
.text:00010901 loc_10901:                         ; CODE XREF:
                                                   ; sub_10604+2A8j
.text:00010901            mov     eax, [ebx+0Ch]  ; eax=input buffer
.text:00010904            xor     edx, edx	  ; edx=0
.text:00010906            mov     [ebp+var_8], eax; store
.text:00010909            cmp     [eax], edx      ; input buffer == 0?
.text:0001090B            jz      short loc_10966 ; if so -> exit
.text:0001090D            mov     edi, [eax+870h] ; edi=addres from
                                                   ; input buffer+870h
.text:00010913            lea     esi, [eax+4]    ; esi=ptr to input
                                                   ; buffer+4
.text:00010916            mov     ecx, 21Ah       ; ecx=21Ah size to
                                                   ; copy (const)
.text:0001091B            rep movsd               ; copy
----// SNIP SNIP //-------------------------------------------------
	
Sending the input buffer written below:

----// SNIP SNIP //-------------------------------------------------
input_buff:
		db "YOU!"
		db 86Ch dup (90h)		  ; source memory (ESI)
		dd 1234567h			  ; destination address
		db "GONDIE"
----// SNIP SNIP //-------------------------------------------------	
	
forces Avast device driver to write data from "source memory" to
destination address (here 1234567h).

	
III. IMPACT

Successful exploitation may allow attacker to obtain full system control
(ring0 priviledges), if the attack fails the operating system will fault.


IV. POC CODE

Poc code was released for this issue.



best regards,
Piotr Bania


-- 
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@...il.com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
http://pb.specialised.info  - Key ID: 0xBE43AC33
--------------------------------------------------------------------

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ