______________________________________________________________________ -------------------------- NSOADV-2010-006 --------------------------- Authentium Command Free Scan ActiveX Control buffer overflow ______________________________________________________________________ ______________________________________________________________________ 111101111 11111 00110 00110001111 111111 01 01 1 11111011111111 11111 0 11 01 0 11 1 1 111011001 11111111101 1 11 0110111 1 1111101111 1001 0 1 10 11 0 10 11 1111111 1 111 111001 111111111 0 10 1111 0 11 11 111111111 1 1101 10 00111 0 0 11 00 0 1110 1 1011111111111 1111111 11 100 10111111 0 01 0 1 1 111110 11 1111111111111 11110000011 0111111110 0110 1110 1 0 11101111111111111011 11100 00 01111 0 10 1110 1 011111 1 111111111111111111111101 01 01110 0 10 111110 110 0 11101111111111111111101111101 111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111 111110110 10 0111110 1 0 0 1111111111111111111111111 110 111 11111 1 1 111 1 10011 101111111111011111111 0 1100 111 10 110 101011110010 11111111111111111111111 11 0011100 11 10 001100 0001 111111111111111111 10 11 11110 11110 00100 00001 10 1 1111 101010001 11111111 11101 0 1011 10000 00100 11100 00001101 0 0110 111011011 0110 10001 101 11110 1011 1 10 101 000001 01 00 1010 1 11001 1 1 101 10 110101011 0 101 11110 110000011 111 ______________________________________________________________________ ______________________________________________________________________ Title: Authentium Command On Demand ActiveX Control Buffer Overflow Severity: High Advisory ID: NSOADV-2010-006 Found Date: 15.02.2010 Date Reported: 22.02.2010 Release Date: 04.03.2010 Author: Nikolas Sotiriu Website: http://sotiriu.de Twitter: http://twitter.com/nsoresearch Mail: nso-research at sotiriu.de URL: http://sotiriu.de/adv/NSOADV-2009-006.txt Vendor: Authentium (http://www.authentium.com/) Affected Products: Authentium Command On Demand Online Scan (http://www.commandondemand.com/) Affected Component: CSS Web Installer ActiveX V.1.4.9508.605 Remote Exploitable: Yes Local Exploitable: No Patch Status: No Patch (See Solution) Discovered by: Nikolas Sotiriu Disclosure Policy: http://sotiriu.de/policy.html Thanks to: Thierry Zoller: For the permission to use his Policy Background: =========== Authentium Command On Demand is a highly-effective, totally free virus scanner. Command on Demand scans for more than half a million Internet threats, using definition files that are updated daily (Product description from Website) Description: ============ Remote exploitation of a buffer overflow vulnerability in Authentium Command On Demand Online scanner service could allow an attacker to execute arbitrary code within the security context of the targeted user. The affected function is "InstallProduct1". The functions "InstallProduct" and "InstallProduct2" seems to be also vulnerable. Name: CSS Web Installer Class Vendor: Authentium, Inc. Type: ActiveX-Control Version: 1.4.9508.605 Prog ID: CSSWEBLib.Installer GUID: {6CCE3920-3183-4B3D-808A-B12EB769DE12} File: cssweb.dll Folder: C:\WINDOWS\Downloaded Program Files\ Safe for Script: True Safe for Init: True IObjectSafety: False Proof of Concept : ================== http://sotiriu.de/software/NSOPOC-2010-006.zip Solution: ========= Product is no longer supported. Disable the vulnerable ActiveX Control by setting the kill bit for the following CLSID: {6CCE3920-3183-4B3D-808A-B12EB769DE12} Save the following text as a .REG file and imported to set the kill bit for this control: +-------------------------------------- Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6CCE3920-3183-4B3D-808A-B12EB769DE12}] "Compatibility Flags"=dword:00000400 +-------------------------------------- More information about how to set the kill bit is available in Microsoft Support Document 240797. (http://support.microsoft.com/kb/240797) Disclosure Timeline (YYYY/MM/DD): ================================= 2010.02.15: Vulnerability found 2010.02.22: Initial contact per Online forms [-] No Response 2010.03.01: Seconad contact per Online forms 2010.03.01: Initial vendor response 2010.03.02: Ask for a direct contact, a PGP Key and send the Disclosure Policy to vendor. 2010.03.02: Got an Email address 2010.03.02: Sent PoC, Advisory, Disclosure policy and planned disclosure date (2010.03.11) to Vendor 2010.03.03: Vendor response that the product is no longer supported and the domain will be taken down. 2010.03.04: Domain is down 2010.03.04: Release of this Advisory