exploit the possibilities

G Data TotalProtection 2014 Code Execution

G Data TotalProtection 2014 Code Execution
Posted Jun 25, 2014
Authored by Kyriakos Economou | Site portcullis-security.com

G Data TotalProtection 2014 version 24.0.2.1 suffers from an arbitrary code execution vulnerability.

tags | advisory, arbitrary, code execution
advisories | CVE-2014-3752
MD5 | eaf678b5f91e58bb6893825ee79fe3e0

G Data TotalProtection 2014 Code Execution

Change Mirror Download
Vulnerability title: Arbitrary Code Execution in G Data TotalProtection 2014
CVE: CVE-2014-3752
Vendor: G Data
Product: TotalProtection 2014
Affected version: v24.0.2.1
Fixed version: N/A
Reported by: Kyriakos Economou

Details:

G Data TotalProtection 2014 v24.0.2.1 and possibly earlier versions are
vulnerable to arbitrary code execution.
A local attacker is able to execute code as SYSTEM by exploiting a bug
in the MiniIcpt.sys (v1.013046.218) device driver.
Other software from the same vendor using the affected driver may also
be vulnerable to the same attack.

This vulnerability doesn’t currently allow elevation of privileges as
the attacker needs administrator rights to trigger the bug.

In particular, IOCTL 0×83170180 leads to:
OR ECX, -1
LOCK XADD DWORD PTR [EAX], ECX

These two instructions are used to decrement a value stored in a memory
location pointed by EAX, but in this case the value of EAX can be
controlled through the IOCTL input buffer from userland.
Any value in writeable memory can be decremented at will by triggering
the vulnerability multiple times.

The challenge in a scenario like this is to find a pointer that could
later be used to control the EIP.
For example, a pointer to another function of the same module could be
used through another IOCTL, if that pointer is stored to a known address
such as in the range of the driver module itself.


Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3752/


Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

June 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    1 Files
  • 2
    Jun 2nd
    2 Files
  • 3
    Jun 3rd
    19 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    15 Files
  • 6
    Jun 6th
    12 Files
  • 7
    Jun 7th
    11 Files
  • 8
    Jun 8th
    1 Files
  • 9
    Jun 9th
    1 Files
  • 10
    Jun 10th
    15 Files
  • 11
    Jun 11th
    15 Files
  • 12
    Jun 12th
    15 Files
  • 13
    Jun 13th
    8 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    2 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    18 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close