Comodo - PackMan Unpacker Insufficient Parameter Validation

2016-03-23T00:00:00
ID EXPLOITPACK:5C5C4BB603AEBEB9CB32CD2BD1CADE4E
Type exploitpack
Reporter Google Security Research
Modified 2016-03-23T00:00:00

Description

Comodo - PackMan Unpacker Insufficient Parameter Validation

                                        
                                            Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=764

Packman is an obscure opensource executable packer that Comodo Antivirus attempts to unpack during scanning. The code is available online here:

http://packmanpacker.sourceforge.net/

If the compression method is set to algorithm 1, compression parameters are read directly from the input executable without validation. Fuzzing this unpacker revealed a variety of crashes due to this, such as causing pointer arithmetic in CAEPACKManUnpack::DoUnpack_With_NormalPack to move pksDeCodeBuffer.ptr to an arbitrary address, which allows an attacker to free() an arbitrary pointer.

This issue is obviously exploitable to execute code as NT AUTHORITY\SYSTEM.

The attached testcase will attempt to free() an invalid pointer to demonstrate this.


Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39601.zip