Document Title: =============== BitDefender Internet Security 2011 - Pointer Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=149 Release Date: ============= 2012-01-26 Vulnerability Laboratory ID (VL-ID): ==================================== 149 Product & Service Introduction: =============================== BitDefender Internet Security 2010 schützt die Online-Aktivitäten Ihrer Familie -ohne die PCs auszubremsen. Es versperrt Viren, Hackern und Spam den Zutritt und bietet Schutz durch Kindersicherung und Firewall. (Copy of the Vendor Homepage: http://www.bitdefender.com/) Abstract Advisory Information: ============================== Vulnerability-Lab Team discovered a critical Pointer Vulnerability on BitDefender Internet Security 2011. Vulnerability Disclosure Timeline: ================================== 2011-04-12: Vendor Notification 2011-**-**: Vendor Response/Feedback 2011-**-**: Vendor Fix/Patch 2012-01-27: Public or Non-Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Local Severity Level: =============== Medium Technical Details & Description: ================================ A Pointer vulnerability is detected on Bitdefenders Internet Security Suite 2011. A local attacker can crash the running software proccess(bdtkexec.exe) via a invalid pointer read misconfiguration. The vulnerability allows an attacker to crash the software process stable after a combined apphang on a main module. The bug is located in the tune-up quick bar menu when a module on the bar hangs. Vulnerable Section: [+] Tune UP Vulnerable Module(s): [+] bdtkexec.exe Proof of Concept (PoC): ======================= The vulnerability can be exploited by local attackers. For demonstration or reproduce ... --- Exception Logs --- The stored exception information can be accessed via .ecxr. (1798.230): Access violation - code c0000005 (first/second chance not available) .exr 0xffffffffffffffff ExceptionAddress: 000007fefd6c28fa (ole32+0x00000000000328fa) ExceptionCode: c0000005 (Access violation) Stack-Text(Cut): 00000000`0012f790 00000000`0021afd8 : 00000011`25000124 00000000`02fe0230 00000fff`ff000000 00000000`00000001 : ole32+0x328fa 00000000`0012f798 00000011`25000124 : 00000000`02fe0230 00000fff`ff000000 00000000`00000001 000007fe`fd6c2748 : 0x21afd8 00000000`0012f7a0 00000000`02fe0230 : 00000fff`ff000000 00000000`00000001 000007fe`fd6c2748 00000005`00000004 : 0x11`25000124 00000000`0012f7a8 00000fff`ff000000 : 00000000`00000001 000007fe`fd6c2748 00000005`00000004 00000000`00000000 : 0x2fe0230 00000000`0012f7b0 00000000`00000001 : 000007fe`fd6c2748 00000005`00000004 00000000`00000000 00000000`04830720 : 0xfff`ff000000 00000000`0012f7b8 000007fe`fd6c2748 : 00000005`00000004 00000000`00000000 00000000`04830720 00000000`0022f6b0 : 0x1 00000000`0012f7c0 00000005`00000004 : 00000000`00000000 00000000`04830720 00000000`0022f6b0 00000000`0020d820 : ole32+0x32748 00000000`0012f7c8 00000000`00000000 : 00000000`04830720 00000000`0022f6b0 00000000`0020d820 00000000`00000000 : 0x5`00000004 Debug Log(Cut): FAULTING_IP: ole32+328fa 000007fe`fd6c28fa 488b01 mov rax,qword ptr [rcx] EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 000007fefd6c28fa (ole32+0x00000000000328fa) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000004830720 Attempt to read from address 0000000004830720 PROCESS_NAME: bdtkexec.exe ADDITIONAL_DEBUG_TEXT: Use '!findthebuild' command to search for the target build information. If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols. MODULE_NAME: ole32 FAULTING_MODULE: 0000000077290000 ntdll DEBUG_FLR_IMAGE_TIMESTAMP: 4a5be01a ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000004830720 READ_ADDRESS: 0000000004830720 FOLLOWUP_IP: ole32+328fa 000007fe`fd6c28fa 488b01 mov rax,qword ptr [rcx] FAULTING_THREAD: 0000000000000230 BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_WRONG_SYMBOLS PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ DEFAULT_BUCKET_ID: INVALID_POINTER_READ IP_ON_HEAP: 000000000021afd8 The fault address in not in any loaded module, please check your build's rebase log at \bin\build_logs\timebuild\ntrebase.log for module which may contain the address if it were loaded. FRAME_ONE_INVALID: 1 LAST_CONTROL_TRANSFER: from 000000000021afd8 to 000007fefd6c28fa Analyses: ../Analyse/Report.wer ../Analyse/WER31AD.tmp.WERInternalMetadata.xml ../Analyse/WER31FC.tmp.hdmp ../Analyse/WER2167.tmp.appcompat.txt ../Analyse/WER3557.tmp.mdmp Manually reproduce ... 1. Try to simulate an app-hang over a specific process in the tune-up quick bar 2. On the app-hang try to configure the quick tune-up menu 3. Enjoy the pointer bug on reading ... Information: Get sure that the process is connected through the structure with the tune-up ... Successfully exploitation requires a bound module apphand on processing. Reference(s): ../Analyse/AppCrash_bdtkexec.exe_402f4b56824685dd788ced57f1351281d724b9_cab_0ca437a5 ../Analyse/AppCrash_bdfvcl.exe_c8126bc070dce08b638651451ee988a22a0e62a_cab_1501a968 Security Risk: ============== The security risk of the pointer vulnerability is estimated as medium(+). Credits & Authors: ================== Vulnerability Research Laboratory - N/A Anonymous Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2012 | Vulnerability Laboratory