exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Panda Antivirus Pro 2015 15.1.0 Authentication Bypass

Panda Antivirus Pro 2015 15.1.0 Authentication Bypass
Posted Apr 15, 2015
Authored by Matthias Deeg | Site syss.de

Panda Antivirus Pro 2015 version 15.1.0 suffers from an authentication bypass vulnerability.

tags | advisory, bypass
SHA-256 | 78e5eb24225a62312d8ad8f761249bc6322d0fa2d403267061a8cea8d3736af3

Panda Antivirus Pro 2015 15.1.0 Authentication Bypass

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2015-013
Product: Panda Antivirus Pro 2015
Vendor: Panda Security
Affected Version(s): 15.1.0
Tested Version(s): 15.1.0
Vulnerability Type: Authentication Bypass Using an Alternate Path or
Channel (CWE-288)
Risk Level: Medium
Solution Status: Not fixed
Vendor Notification: 2015-02-27
Solution Date: -
Public Disclosure: 2015-04-14
CVE Reference: Not yet assigned
Author of Advisory: Matthias Deeg (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Panda Antivirus Pro 2015 is an antivirus software with many features
defending users against different threats.

The vendor Panda Security describes the product as follows (see [1]):

"Panda Antivirus Pro 2015 is truly 'install and forget'. Remove viruses
and any other threats or malware from your computer. Essential anti
virus that offers real-time protection for your PC."

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The endpoint protection software Panda Antivirus Pro 2015 offers a
password protection in order to restrict access to the management
console. With an enabled password protection, changing settings or
deactivating the protection features requires the set password.

By analyzing the password-based authentication of the implemented
password protection, the SySS GmbH found out, that the password
comparison is done within the process PSUAMain.exe (actually within the
used module PSUNConsole.dll), which runs in the context of the current
Windows user, who can also be a standard, limited user.

This fact allows a further analysis and the manipulation of the password
comparison during runtime without administrative privileges, as every
user is able to debug and manipulate the processes running with her user
privileges.

In order to bypass the password-based authentication, for example to
deactivate the protection of Panda Antivirus Pro 2015 in an unauthorized
manner, an attacker only has to patch this password comparison, so that
it always returns true, for example by comparing the correct unload
password with itself or by modifying the program control flow.

The SySS GmbH also found out, that the actual set password for the
password protection can be extracted as cleartext during runtime from
the process PSUAMain.exe.

Thus, a limited Windows user or malware running in the context of such a
user is able to deactivate Panda Antivirus Pro 2015 in an unauthorized
manner and furthermore to extract the actual password as cleartext.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The SySS GmbH developed a proof-of-concept software tool named
UnloadPanda for deactivating the Panda protection in an unauthorized
manner.

The following output exemplarily shows a successful bypass of the
password-based authentication and of the cleartext password extraction:

>UnloadPanda.exe
____________________________________________________________
/ _____ _____ _____ \
/ / ___| / ___/ ___| \
| \ `--. _ _\ `--.\ `--. |
| `--. \ | | |`--. \`--. \ |
| /\__/ / |_| /\__/ /\__/ / |
\ \____/ \__, \____/\____/ ... unloads Panda! /
\ __/ | /
/ |___/ _________________________________________/
/ _________________/
(__) /_/
(oo)
/------\/
/ |____||
* || ||
^^ ^^
SySS Unload Panda Protection v1.0 by Matthias Deeg - SySS GmbH (c) 2015

[+] The Panda process was patched successfully.
Now you can unload the Panda protection with an arbitrary password.
After entering an arbitrary password, the correct one will be shown.
[+] The correct password is: s3cret1!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The SySS GmbH is currently not aware of a solution for the reported
security vulnerability.

Please contact the vendor for further information.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2015-02-27: Vulnerability reported to vendor
2015-03-06: Reported vulnerability again as the vendor did not reply to
to the first e-mail with the SySS security advisory
2015-03-06: Vendor acknowledges e-mail with SySS security advisory and
opens a case
2015-04-14: Public release of security advisory according to the SySS
Responsible Disclosure Policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product Web site for Panda Antivirus Pro 2015
http://www.pandasecurity.com/usa/homeusers/solutions/antivirus/
[2] SySS Security Advisory SYSS-2015-013
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-013.txt
[3] SySS Responsible Disclosure Policy
https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Matthias Deeg.

E-Mail: matthias.deeg (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc
Key fingerprint = 5AE3 96EE A014 FB90 9D81 AF90 8C54 7E88 A34C CED8

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEAREKAAYFAlUs5sYACgkQjFR+iKNMztglWQCgkeidYnWnC/Im/VKZOFTOc+rs
9YgAoMhbEu3lbC59nhcS30jKhycUXeDy
=Mv2a
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

August 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    15 Files
  • 2
    Aug 2nd
    22 Files
  • 3
    Aug 3rd
    0 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    11 Files
  • 7
    Aug 7th
    43 Files
  • 8
    Aug 8th
    42 Files
  • 9
    Aug 9th
    36 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    27 Files
  • 13
    Aug 13th
    18 Files
  • 14
    Aug 14th
    50 Files
  • 15
    Aug 15th
    33 Files
  • 16
    Aug 16th
    23 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    43 Files
  • 20
    Aug 20th
    29 Files
  • 21
    Aug 21st
    42 Files
  • 22
    Aug 22nd
    26 Files
  • 23
    Aug 23rd
    25 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    21 Files
  • 27
    Aug 27th
    28 Files
  • 28
    Aug 28th
    15 Files
  • 29
    Aug 29th
    41 Files
  • 30
    Aug 30th
    13 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close