|
|
______________________________________________________________________
-------------------------- NSOADV-2010-006 ---------------------------
Authentium Command Free Scan ActiveX Control buffer overflow
______________________________________________________________________
______________________________________________________________________
111101111
11111 00110 00110001111
111111 01 01 1 11111011111111
11111 0 11 01 0 11 1 1 111011001
11111111101 1 11 0110111 1 1111101111
1001 0 1 10 11 0 10 11 1111111 1 111 111001
111111111 0 10 1111 0 11 11 111111111 1 1101 10
00111 0 0 11 00 0 1110 1 1011111111111 1111111 11 100
10111111 0 01 0 1 1 111110 11 1111111111111 11110000011
0111111110 0110 1110 1 0 11101111111111111011 11100 00
01111 0 10 1110 1 011111 1 111111111111111111111101 01
01110 0 10 111110 110 0 11101111111111111111101111101
111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111
111110110 10 0111110 1 0 0 1111111111111111111111111 110
111 11111 1 1 111 1 10011 101111111111011111111 0 1100
111 10 110 101011110010 11111111111111111111111 11 0011100
11 10 001100 0001 111111111111111111 10 11 11110
11110 00100 00001 10 1 1111 101010001 11111111
11101 0 1011 10000 00100 11100 00001101 0
0110 111011011 0110 10001 101 11110
1011 1 10 101 000001 01 00
1010 1 11001 1 1 101 10
110101011 0 101 11110
110000011
111
______________________________________________________________________
______________________________________________________________________
Title: Authentium Command On Demand ActiveX Control
Buffer Overflow
Severity: High
Advisory ID: NSOADV-2010-006
Found Date: 15.02.2010
Date Reported: 22.02.2010
Release Date: 04.03.2010
Author: Nikolas Sotiriu
Website: http://sotiriu.de
Twitter: http://twitter.com/nsoresearch
Mail: nso-research at sotiriu.de
URL: http://sotiriu.de/adv/NSOADV-2009-006.txt
Vendor: Authentium (http://www.authentium.com/)
Affected Products: Authentium Command On Demand Online Scan
(http://www.commandondemand.com/)
Affected Component: CSS Web Installer ActiveX V.1.4.9508.605
Remote Exploitable: Yes
Local Exploitable: No
Patch Status: No Patch (See Solution)
Discovered by: Nikolas Sotiriu
Disclosure Policy: http://sotiriu.de/policy.html
Thanks to: Thierry Zoller: For the permission to use his
Policy
Background:
==========
Authentium Command On Demand is a highly-effective, totally free virus
scanner. Command on Demand scans for more than half a million Internet
threats, using definition files that are updated daily
(Product description from Website)
Description:
===========
Remote exploitation of a buffer overflow vulnerability in Authentium
Command On Demand Online scanner service could allow an attacker to
execute arbitrary code within the security context of the targeted user.
The affected function is "InstallProduct1". The functions
"InstallProduct" and "InstallProduct2" seems to be also vulnerable.
Name: CSS Web Installer Class
Vendor: Authentium, Inc.
Type: ActiveX-Control
Version: 1.4.9508.605
Prog ID: CSSWEBLib.Installer
GUID: {6CCE3920-3183-4B3D-808A-B12EB769DE12}
File: cssweb.dll
Folder: C:\WINDOWS\Downloaded Program Files\
Safe for Script: True
Safe for Init: True
IObjectSafety: False
Proof of Concept :
=================
http://sotiriu.de/software/NSOPOC-2010-006.zip
Solution:
========Product is no longer supported.
Disable the vulnerable ActiveX Control by setting the kill bit for the
following CLSID:
{6CCE3920-3183-4B3D-808A-B12EB769DE12}
Save the following text as a .REG file and imported to set the kill bit
for this control:
+--------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX
Compatibility\{6CCE3920-3183-4B3D-808A-B12EB769DE12}]
"Compatibility Flags"=dword:00000400
+--------------------------------------
More information about how to set the kill bit is available in Microsoft
Support Document 240797 (http://support.microsoft.com/kb/240797).
Disclosure Timeline (YYYY/MM/DD):
================================
2010.02.15: Vulnerability found
2010.02.22: Initial contact per Online forms
[-] No Response
2010.03.01: Seconad contact per Online forms
2010.03.01: Initial vendor response
2010.03.02: Ask for a direct contact, a PGP Key and send the Disclosure
Policy to vendor.
2010.03.02: Got an Email address
2010.03.02: Sent PoC, Advisory, Disclosure policy and planned disclosure
date (2010.03.11) to Vendor
2010.03.03: Vendor response that the product is no longer supported and
the domain will be taken down.
2010.03.04: Domain is down
2010.03.04: Release of this Advisory