Message-ID: <6A1278F7E5264BB391F0554BE69ADE68@W340>
Date: Fri, 18 Dec 2015 01:01:18 +0100
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <fulldisclosure@...lists.org>
Cc: bugtraq@...urityfocus.com
Subject: [FD] Executable uninstallers are vulnerable^WEVIL (case 12): Avira
	Registry Cleaner allows arbitrary code execution with
	escalation of privilege

Hi @ll,

avira_registry_cleaner_en.exe, available from
<https://www.avira.com/en/download/product/avira-registry-cleaner>
to clean up remnants the uninstallers of their snakeoil products
fail to remove, is vulnerable: it loads and executes WTSAPI32.dll,
UXTheme.dll and RichEd20.dll from its application directory
(tested and verified under Windows XP SP3 and Windows 7 SP1).


For software downloaded with a web browser this is typically the
"Downloads" directory: see
<https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html>,
<http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html>
and <http://seclists.org/fulldisclosure/2012/Aug/134>

Additionally see
<https://blogs.msdn.microsoft.com/oldnewthing/20101111-00/?p=12303>:
the above named DLLs are delay-loaded.
You had been warned, kids!


Due to the application manifest embedded in the executable which
specifies "requireAdministrator" Windows' "user account control"
runs it with administrative privileges ("protected" administrators
are prompted for consent, unprivileged standard users are prompted
for an administrator password); execution of WTSAPI32.dll, UXTheme.dll
and/or RichEd20.dll thus results in an escalation of privilege!

If WTSAPI32.dll, UXTheme.dll or RichEd20.dll gets planted in the
users "Downloads" directory per "drive-by download" this
vulnerability becomes a remote code execution WITH escalation of
privilege.


Proof of concept/demonstration:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1. visit <http://home.arcor.de/skanthak/sentinel.html>, download
   <http://home.arcor.de/skanthak/download/SENTINEL.DLL>, save
   it as WTSAPI32.dll in your "Downloads" directory, then copy it
   as UXTheme.dll and RichEd20.dll;

2. download avira_registry_cleaner_en.exe from
   <https://www.avira.com/en/download/product/avira-registry-cleaner>
   and save it in your "Downloads" directory;

3. execute avira_registry_cleaner_en.exe from your "Downloads"
   directory;

4. notice the message boxes displayed from WTSAPI32.dll, UXTheme.dll
   and/or RichEd20.dll placed in step 1.


stay tuned
Stefan Kanthak


Timeline:
~~~~~~~~~

2015-11-15    vulnerability report sent to vendor

2015-11-16    vendor acknowledges receipt

2015-11-17    vendor verifies vulnerability report and anounces to
              publish a fix within two weeks

2015-11-18    asked vendor to request a CVE identifier and check
              their other executable (un)installers too

2015-11-19    vendor replies:
              "We updated our compiler and its runtime to a version
               which should mitigate the attack vector and modified
               the DLL load order"

2015-12-08    notification from vendor:
              "We released a fixed version today"

2015-12-08    your "fixed" cleaner still loads the named DLLs

2015-12-09    response from vendor, asking how I verified execution
              of UXTheme.dll, with screenshot of "Process Monitor"
              showing the tell-tale line
              "C:\Users\...\Downloads\CRYPTBASE.dll    NAME NOT FOUND"

2015-12-09    see <http://seclists.org/fulldisclosure/2015/Nov/101>

              sent SAFER.log produced on Windows XP and Windows 7 to
              vendor; also told them to look at the screenshot!

2015-12-17    response from vendor:
              "We don't see a vulnerability in the attempt to load
               CRYPTBASE.dll from the application directory as shown
               by Process Monitor. We think we fixed the reported
               vulnerabilities and will not provide another fix."

OUCH!
I really LOVE snakeoil vendors who DON'T care about the safety and
security of their customers.

2015-12-18    report published

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists