Exploit the possiblities

G Data TotalProtection 2014 Code Execution

G Data TotalProtection 2014 Code Execution
Posted Jun 25, 2014
Authored by Kyriakos Economou | Site portcullis-security.com

G Data TotalProtection 2014 version suffers from an arbitrary code execution vulnerability.

tags | advisory, arbitrary, code execution
advisories | CVE-2014-3752
MD5 | eaf678b5f91e58bb6893825ee79fe3e0

G Data TotalProtection 2014 Code Execution

Change Mirror Download
Vulnerability title: Arbitrary Code Execution in G Data TotalProtection 2014
CVE: CVE-2014-3752
Vendor: G Data
Product: TotalProtection 2014
Affected version: v24.0.2.1
Fixed version: N/A
Reported by: Kyriakos Economou


G Data TotalProtection 2014 v24.0.2.1 and possibly earlier versions are
vulnerable to arbitrary code execution.
A local attacker is able to execute code as SYSTEM by exploiting a bug
in the MiniIcpt.sys (v1.013046.218) device driver.
Other software from the same vendor using the affected driver may also
be vulnerable to the same attack.

This vulnerability doesn’t currently allow elevation of privileges as
the attacker needs administrator rights to trigger the bug.

In particular, IOCTL 0×83170180 leads to:
OR ECX, -1

These two instructions are used to decrement a value stored in a memory
location pointed by EAX, but in this case the value of EAX can be
controlled through the IOCTL input buffer from userland.
Any value in writeable memory can be decremented at will by triggering
the vulnerability multiple times.

The challenge in a scenario like this is to find a pointer that could
later be used to control the EIP.
For example, a pointer to another function of the same module could be
used through another IOCTL, if that pointer is stored to a known address
such as in the range of the driver module itself.

Further details at:

Copyright (c) Portcullis Computer Security Limited 2014, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.

The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information.


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?

Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

March 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    14 Files
  • 2
    Mar 2nd
    12 Files
  • 3
    Mar 3rd
    1 Files
  • 4
    Mar 4th
    3 Files
  • 5
    Mar 5th
    15 Files
  • 6
    Mar 6th
    23 Files
  • 7
    Mar 7th
    15 Files
  • 8
    Mar 8th
    15 Files
  • 9
    Mar 9th
    3 Files
  • 10
    Mar 10th
    2 Files
  • 11
    Mar 11th
    1 Files
  • 12
    Mar 12th
    16 Files
  • 13
    Mar 13th
    20 Files
  • 14
    Mar 14th
    14 Files
  • 15
    Mar 15th
    17 Files
  • 16
    Mar 16th
    15 Files
  • 17
    Mar 17th
    5 Files
  • 18
    Mar 18th
    2 Files
  • 19
    Mar 19th
    7 Files
  • 20
    Mar 20th
    15 Files
  • 21
    Mar 21st
    18 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2018 Packet Storm. All rights reserved.

Security Services
Hosting By