exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Panda Global Protection 2015 15.1.0 Authentication Bypass

Panda Global Protection 2015 15.1.0 Authentication Bypass
Posted Apr 15, 2015
Authored by Matthias Deeg | Site syss.de

Panda Global Protection 2015 version 15.1.0 suffers from an authentication bypass vulnerability.

tags | advisory, bypass
SHA-256 | b0ce784ce3941c3e2211727da49529f55f628d6bc53a8a07e077f4926fefc997

Panda Global Protection 2015 15.1.0 Authentication Bypass

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2015-014
Product: Panda Global Protection 2015
Vendor: Panda Security
Affected Version(s): 15.1.0
Tested Version(s): 15.1.0
Vulnerability Type: Authentication Bypass Using an Alternate Path or
Channel (CWE-288)
Risk Level: Medium
Solution Status: Not fixed
Vendor Notification: 2015-02-27
Solution Date: -
Public Disclosure: 2015-04-14
CVE Reference: Not yet assigned
Author of Advisory: Matthias Deeg (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Panda Global Protection 2015 is an endpoint protection software with
many features defending users against different threats.

The vendor Panda Security describes the product as follows (see [1]):

"Everything you need to protect your PC, Mac® or Android™, your data and
family against all types of threats, even those as yet undiscovered, is
included in our antivirus software. Enjoy real time protection against
the latest malware. Surf, shop and play online with complete peace of
mind."

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The endpoint protection software Panda Global Protection 2015 offers a
password protection in order to restrict access to the management
console. With an enabled password protection, changing settings or
deactivating the protection features requires the set password.

By analyzing the password-based authentication of the implemented
password protection, the SySS GmbH found out, that the password
comparison is done within the process PSUAMain.exe (actually within the
used module PSUNConsole.dll), which runs in the context of the current
Windows user, who can also be a standard, limited user.

This fact allows a further analysis and the manipulation of the password
comparison during runtime without administrative privileges, as every
user is able to debug and manipulate the processes running with her user
privileges.

In order to bypass the password-based authentication, for example to
deactivate the protection of Panda Global Protection 2015 in an
unauthorized manner, an attacker only has to patch this password
comparison, so that it always returns true, for example by comparing the
correct unload password with itself or by modifying the program control
flow.

The SySS GmbH also found out, that the actual set password for the
password protection can be extracted as cleartext during runtime from
the process PSUAMain.exe.

Thus, a limited Windows user or malware running in the context of such a
user is able to deactivate Panda Global Protection 2015 in an
unauthorized manner and furthermore to extract the actual password as
cleartext.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The SySS GmbH developed a proof-of-concept software tool named
UnloadPanda for deactivating the Panda protection in an unauthorized
manner.

The following output exemplarily shows a successful bypass of the
password-based authentication and of the cleartext password extraction:

>UnloadPanda.exe
____________________________________________________________
/ _____ _____ _____ \
/ / ___| / ___/ ___| \
| \ `--. _ _\ `--.\ `--. |
| `--. \ | | |`--. \`--. \ |
| /\__/ / |_| /\__/ /\__/ / |
\ \____/ \__, \____/\____/ ... unloads Panda! /
\ __/ | /
/ |___/ _________________________________________/
/ _________________/
(__) /_/
(oo)
/------\/
/ |____||
* || ||
^^ ^^
SySS Unload Panda Protection v1.0 by Matthias Deeg - SySS GmbH (c) 2015

[+] The Panda process was patched successfully.
Now you can unload the Panda protection with an arbitrary password.
After entering an arbitrary password, the correct one will be shown.
[+] The correct password is: s3cret1!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The SySS GmbH is currently not aware of a solution for the reported
security vulnerability.

Please contact the vendor for further information.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2015-02-27: Vulnerability reported to vendor
2015-03-06: Reported vulnerability again as the vendor did not reply to
to the first e-mail with the SySS security advisory
2015-03-06: Vendor acknowledges e-mail with SySS security advisory and
opens a case
2015-04-14: Public release of security advisory according to the SySS
Responsible Disclosure Policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product Web site for Panda Global Protection 2015
http://www.pandasecurity.com/usa/homeusers/solutions/global-protection/
[2] SySS Security Advisory SYSS-2015-014
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-014.txt
[3] SySS Responsible Disclosure Policy
https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Matthias Deeg.

E-Mail: matthias.deeg (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc
Key fingerprint = 5AE3 96EE A014 FB90 9D81 AF90 8C54 7E88 A34C CED8

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEAREKAAYFAlUs5s0ACgkQjFR+iKNMztjX+gCbBRjnqChHbAH7VKc3Hetkhn8R
U1UAn1SmDWzMDyEFo51bVZMCdz6pIFXT
=+69b
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close