ShineShadow Security Report 22102009-12

TITLE

Avast! Multiple Vulnerabilities

BACKGROUND

Avast! antivirus software represents complete virus protection, offering full desktop security including a resident shield. Daily automatic updates ensure continuous data protection against all types of malware and spyware. Avast! antivirus is certified by both ICSA Labs and West Coast Labs Checkmark.
Avast! Professional Edition 4.8 is a collection of award winning, high-end technologies that work in perfect synergy, having one common goal: to protect your system and valuable data against computer viruses, spyware and rootkits. It represents a best-in-class antivirus solution for any Windows-based workstation.

Source: http://www.avast.com

VULNERABLE PRODUCTS

Vulnerability #1 (CVE-2009-3524)

Avast! Professional Edition <= 4.8.1351
Avast! Home Edition <= 4.8.1351

Vulnerability #2

Avast! Professional Edition <= 4.8.1356
Avast! Home Edition <= 4.8.1356

DETAILS

Avast! installs some program files with insecure permissions. "Everyone" group has "Full Control" rights to the files/folders in the following path: "%Program Files%\Alwil Software\Avast4\Data". Its mean that any unprivileged user can modify, delete or change permissions of any file in DATA folder. The folder consists of data, executable and configuration files. In result multiple attack vectors are possible.

Vulnerability #1 Local privilege escalation (CVE-2009-3524)

A local attacker (unprivileged user) can modify %Program Files%\Alwil Software\Avast4\Data\avast4.ini file. "ISAPIFilter1" parameter in avast4.ini contains filename or full path to ISAPI filter module =96 originally "ashWsFtr.dll". An attacker can replace the original path by path to the attackers malicious dynamic library (DLL). After restart attackers DLL will be loaded with SYSTEM privileges. This is local privilege escalation vulnerability.

Vulnerability #2 Denial of Service

A local attacker (unprivileged user) could cause denial of service conditions in Avast! by deleting %Program Files%\Alwil Software\Avast4\Data\400.vps file. After system restart all Avast! modules failed to load.

EXPLOITATION

An attacker must have valid logon credentials to a system where vulnerable software is installed.

WORKAROUND

Vulnerability #1 (CVE-2009-3524)

Alwil Software has addressed this vulnerability by releasing fixed versions of the vulnerable products:
Avast! Professional Edition 4.8.1356
Avast! Home Edition 4.8.1356
More detail: http://www.avast.com/eng/avast-4-home_pro-revision-history.html
Insecure permissions on DATA folder have not been fixed, vendor solved the vulnerability  by securing "ISAPIFilter1" parameter.

Vulnerability #2
No workarounds.

Regarding insecure permissions on DATA folder vendor response the following:
"The issue is addressed in the upcoming avast v5.0 (due this November) but there are no plans to do anything about it in the current version (4.x branch)."

DISCLOSURE TIMELINE

25/08/2009 Initial vendor notification. Secure contacts requested.
26/08/2009 Vendor response
27/08/2009 Vulnerability details sent (Vulnerability #1). Confirmation requested. No reply.
01/09/2009 Vulnerability details sent (Vulnerability #1). Confirmation requested.
03/09/2009 Vendor accepted issue for investigation
23/09/2009 Update status query sent to vendor. No reply.
25/09/2009 Vendor released Avast! 4.8.1356. Multiple vulnerabilities have been fixed in this version including Vulnerability #1.
01/10/2009 CVE-2009-3524 has been assigned to Vulnerability #1.
02/10/2009 Vendor has been notified that the Avast! 4.8.1356 fix described privilege escalation scenario only and does not fix the nature of vulnerability =96 insecure permissions. As the proof the new attack scenario has been discovered (Vulnerability #2) and vendor has been notified. No reply.
06/10/2009 Resend notification
06/10/2009 Vendor response regarding insecure permissions: "The issue is addressed in the upcoming avast v5.0 (due this November) but there are no plans to do anything about it in the current version (4.x branch)."
22/10/2009 Advisory released

CREDITS

Maxim A. Kulakov (ShineShadow)
ss_contacts[at]hotmail.com