Twenty Year Anniversary

G Data TotalProtection 2014 Code Execution

G Data TotalProtection 2014 Code Execution
Posted Jun 25, 2014
Authored by Kyriakos Economou | Site portcullis-security.com

G Data TotalProtection 2014 version 24.0.2.1 suffers from an arbitrary code execution vulnerability.

tags | advisory, arbitrary, code execution
advisories | CVE-2014-3752
MD5 | eaf678b5f91e58bb6893825ee79fe3e0

G Data TotalProtection 2014 Code Execution

Change Mirror Download
Vulnerability title: Arbitrary Code Execution in G Data TotalProtection 2014
CVE: CVE-2014-3752
Vendor: G Data
Product: TotalProtection 2014
Affected version: v24.0.2.1
Fixed version: N/A
Reported by: Kyriakos Economou

Details:

G Data TotalProtection 2014 v24.0.2.1 and possibly earlier versions are
vulnerable to arbitrary code execution.
A local attacker is able to execute code as SYSTEM by exploiting a bug
in the MiniIcpt.sys (v1.013046.218) device driver.
Other software from the same vendor using the affected driver may also
be vulnerable to the same attack.

This vulnerability doesn’t currently allow elevation of privileges as
the attacker needs administrator rights to trigger the bug.

In particular, IOCTL 0×83170180 leads to:
OR ECX, -1
LOCK XADD DWORD PTR [EAX], ECX

These two instructions are used to decrement a value stored in a memory
location pointed by EAX, but in this case the value of EAX can be
controlled through the IOCTL input buffer from userland.
Any value in writeable memory can be decremented at will by triggering
the vulnerability multiple times.

The challenge in a scenario like this is to find a pointer that could
later be used to control the EIP.
For example, a pointer to another function of the same module could be
used through another IOCTL, if that pointer is stored to a known address
such as in the range of the driver module itself.


Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3752/


Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

August 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    19 Files
  • 2
    Aug 2nd
    17 Files
  • 3
    Aug 3rd
    16 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    1 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    15 Files
  • 8
    Aug 8th
    9 Files
  • 9
    Aug 9th
    7 Files
  • 10
    Aug 10th
    10 Files
  • 11
    Aug 11th
    1 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    14 Files
  • 14
    Aug 14th
    18 Files
  • 15
    Aug 15th
    38 Files
  • 16
    Aug 16th
    5 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close