Hello Bugtraq.

I write to notify a vulnerability in Kaspersky Antivirus that allows
the code injection in the process that is executed in user's context,
allowing:

1.  The modification, creation and elimination of the values and keys
in the Registration with respect to the configuration of the
antivirus.

2.  The modification, creation and elimination of folders and files in
the installation directory protected by this.

The versions in which this vulnerability has been proven have been the
following ones:

4.0.9.0
5.0.712
6.0.2.690
6.0.3.837

The version 6.0.4.1217, it detects and it refuses the intrusion; the
version 7.0.1.325 don't detect the intrusion but it doesn't execute
the exploit.

The code injection is possible from an user restricted with minimum privileges

The vulnerability this related with Pro-active Defense, specifically
in the event of Sub-control of Windows, which controls the
installation of hooks among applications; this for defect comes
disabled when installing the antivirus allowing this breach of
security, because it is not verified on the part of the protection.

The vulnerability can be mitigated activating the event of Sub-control
of Windows.

The exploit is simple:

1. To obtain the one identifies of a thread associated to a window of
the antivirus, by means of the function GetWindowThreadProcessId ().

ThId=GetWindowThreadProcessId (hWnd, & Pid);

2. To install the hook by means of the function SetWindowsHookEx
associated to our dll.

hHook=SetWindowsHookEx (WH_GETMESSAGE, HookProc, hMod, ThId);

3. And to send a message to the window for the activation of the installed hook.

SendMessage (hWnd, WM_SETFOCUS,0,0);


The vulnerability was notified to Kaspersky Lab the January 20 2010.