full-disclosure - [FD] Avira Antivirus >= 15.0.21.86 Command Execution (SYSTEM)

Open Source and information security mailing list archives

Message-ID: <CAKvdgaP_aWDx3KYejvKqGArOqha2_G2M6ww4OaC=+x5R9+6gvw@mail.gmail.com>
Date: Tue, 8 Nov 2016 19:18:12 +0100
From: Rio Sherri <rio.sherri@...nstudent.info>
To: fulldisclosure <fulldisclosure@...lists.org>
Subject: [FD] Avira Antivirus >= 15.0.21.86 Command Execution (SYSTEM)

# Title :  Avira Antivirus >= 15.0.21.86 Command Execution (SYSTEM)
# Date : 08/11/2016
# Author : R-73eN
# Tested on: Avira Antivirus 15.0.21.86 in Windows 7
# Vendor : https://www.avira.com/
# Disclosure Timeline:
# 2016-06-28 - Reported to Vendor through Bugcrowd.
# 2016-06-29 - Vendor Replied.
# 2016-07-05 - Vendor Replicated the vulnerability.
# 2016-09-02 - Vendor released updated version which fix the vulnerability.
# 2016-11-08 - Public Disclosure
# I would like to thank Avira security team for the quick response.
#
# Vulnerability Description:
# When the Avira Launcher manual update imports a zip file doesn't checks
for " ../ "
# characters which makes it possible to do a path traversal and write
anywhere in the system.
# Vulnerability Replication
# 1. Create a special crafted zip file with the python script attached.
# 2. The script will create a zip file named xvdf_fusebundle.zip with a
filename test.bat (this can be changed) and will write this file to the
root directory C:\
# 3. You can change the directory go to startup and when the user reboots
the script will get executed or you can write a malicious dll to a program
directory or
#    system32 directory which will get loaded and we gain remote command
execution.
# 4. Open avira free antivirus
# 5. Go to update -> Manual Update
# 6. Select the malicious file
# 7. Directory traversal was sucessfull
# Youtube Video: https://www.youtube.com/watch?v=IIEgWiDcw2Q

View attachment "vulnerability.txt" of type "text/plain" (2294 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives