what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

ZoneAlarm DLL Hijacking

ZoneAlarm DLL Hijacking
Posted Jan 7, 2016
Authored by Stefan Kanthak

ZoneAlarm installers suffer from a DLL hijacking vulnerability.

tags | exploit
systems | windows
SHA-256 | 3cf21572a66055de83c57f610ece78c8508a64444a975d3151ee4d6e2235852f

ZoneAlarm DLL Hijacking

Change Mirror Download
Hi @ll,

the executable installers ZASPSetupWeb_141_011_000.exe and
zafwSetupWeb_141_011_000.exe load and execute (at least)
UXTheme.dll, WindowsCodecs.dll and ProfAPI.dll from their
"application directory".

For software downloaded with a web browser the application
directory is typically the user's "Downloads" directory: see
<https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html>,
<http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html>
and <http://seclists.org/fulldisclosure/2012/Aug/134> for "prior art"
about this well-known and well-documented vulnerability.


If an attacker places the above named DLLs in the users "Downloads"
directory (for example per drive-by download or social engineering)
this vulnerability becomes a remote code execution.

Due to the application manifest embedded in the executables which
specifies "requireAdministrator" the executable installers are run
with administrative privileges ("protected" administrators are
prompted for consent, unprivileged standard users are prompted for
an administrator password); execution of the DLLs therefore results
in an escalation of privilege!


Proof of concept (verified on Windows XP, Windows Vista, Windows 7,
Windows Server 2008 [R2]; should work on newer versions too):

1. visit <http://home.arcor.de/skanthak/sentinel.html>, download
<http://home.arcor.de/skanthak/download/SENTINEL.DLL> and save
it as UXTheme.dll in your "Downloads" directory, then copy it
as ProfAPI.dll and WindowsCodecs.dll;

2. download ZASPSetupWeb_141_011_000.exe and/or
zafwSetupWeb_141_011_000.exe and save them in your "Downloads"
directory;

3. run ZASPSetupWeb_141_011_000.exe and/or
zafwSetupWeb_141_011_000.exe from the "Downloads" directory.

PWNED!


>From the vendor's web site
<http://www.zonealarm.com/security/en-us/fza-install-steps.htm>

| To start installation:
| * Click Save File on the browser pop up.
...
| * By default your downloaded file will be in the Downloads
| folder under Documents. Double-click the zafwSetupWeb.exe
| file to begin installation.

OUCH!


For this well-known (trivial, easy to avoid, easy to detect and
easy to fix) beginner's error see
<https://capec.mitre.org/data/definitions/471.html>,
<https://technet.microsoft.com/en-us/library/2269637.aspx>,
<https://msdn.microsoft.com/en-us/library/ff919712.aspx> and
<https://msdn.microsoft.com/en-us/library/ms682586.aspx> plus
<http://blogs.technet.com/b/srd/archive/2014/05/13/load-library-safely.aspx>


Additionally: ZASPSetupWeb_141_011_000.exe and
zafwSetupWeb_141_011_000.exe create the UNSAFE temporary directory
%TEMP%\{907A1104-E812-4b5c-959B-E4DAB37A96AB} to unpack their
payload and download other executables, including your real
executable installer install.exe, which has but the same bugs!


Proof of concept (verified on Windows XP, Windows Vista, Windows 7,
Windows Server 2008 [R2]; should work on newer versions too):

4. create the directory %TEMP%\{907A1104-E812-4b5c-959B-E4DAB37A96AB};

5. copy UXTheme.dll and WindowsCodecs.dll downloaded in step 1
above into this empty directory;
for a denial of service copy it as PowrProf.dll, WebIO.dll,
WinHttp.dll, Version.dll and MSWSock.dll (or create your own
DLL which exports the referenced entries to have them loaded
and executed too);

6. run ZASPSetupWeb_141_011_000.exe and/or
zafwSetupWeb_141_011_000.exe from step 3 above.

PWNED! resp. DOSSED!


For this well-known (trivial, easy to avoid, easy to detect and
easy to fix) beginner's error see
<https://cwe.mitre.org/data/definitions/377.html>,
<https://cwe.mitre.org/data/definitions/379.html>,
<https://capec.mitre.org/data/definitions/27.html>,
<https://capec.mitre.org/data/definitions/29.html> ...


See <http://seclists.org/fulldisclosure/2015/Nov/101>,
<http://seclists.org/fulldisclosure/2015/Dec/86> and
<http://seclists.org/fulldisclosure/2015/Dec/121> plus
<http://home.arcor.de/skanthak/sentinel.html> and the still unfinished
<http://home.arcor.de/skanthak/!execute.html> for more details and why
executable installers (and self-extractors too) are bad and should be
dumped.


stay tuned
Stefan Kanthak


PS: I really LOVE (security) software with such trivial beginner's
errors. It's a tell-tale sign to stay away from this crapware!


Timeline:
~~~~~~~~~

2015-12-13 report sent to vendor

NO ANSWER, not even an acknowledgement of receipt

2015-12-23 reports resent to vendor

NO ANSWER, not even an acknowledgement of receipt

2016-01-01 reports resent to vendor

NO ANSWER, not even an acknowledgement of receipt

2016-01-07 report published
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close