ZoneAlarm DLL Hijacking

`Hi @ll,  
  
the executable installers ZASPSetupWeb_141_011_000.exe and  
zafwSetupWeb_141_011_000.exe load and execute (at least)  
UXTheme.dll, WindowsCodecs.dll and ProfAPI.dll from their  
"application directory".  
  
For software downloaded with a web browser the application  
directory is typically the user's "Downloads" directory: see  
<https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html>,  
<http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html>  
and <http://seclists.org/fulldisclosure/2012/Aug/134> for "prior art"  
about this well-known and well-documented vulnerability.  
  
  
If an attacker places the above named DLLs in the users "Downloads"  
directory (for example per drive-by download or social engineering)  
this vulnerability becomes a remote code execution.  
  
Due to the application manifest embedded in the executables which  
specifies "requireAdministrator" the executable installers are run  
with administrative privileges ("protected" administrators are  
prompted for consent, unprivileged standard users are prompted for  
an administrator password); execution of the DLLs therefore results  
in an escalation of privilege!  
  
  
Proof of concept (verified on Windows XP, Windows Vista, Windows 7,  
Windows Server 2008 [R2]; should work on newer versions too):  
  
1. visit <http://home.arcor.de/skanthak/sentinel.html>, download  
<http://home.arcor.de/skanthak/download/SENTINEL.DLL> and save  
it as UXTheme.dll in your "Downloads" directory, then copy it  
as ProfAPI.dll and WindowsCodecs.dll;  
  
2. download ZASPSetupWeb_141_011_000.exe and/or  
zafwSetupWeb_141_011_000.exe and save them in your "Downloads"  
directory;  
  
3. run ZASPSetupWeb_141_011_000.exe and/or  
zafwSetupWeb_141_011_000.exe from the "Downloads" directory.  
  
PWNED!  
  
  
>From the vendor's web site  
<http://www.zonealarm.com/security/en-us/fza-install-steps.htm>  
  
| To start installation:  
| * Click Save File on the browser pop up.  
...  
| * By default your downloaded file will be in the Downloads  
| folder under Documents. Double-click the zafwSetupWeb.exe  
| file to begin installation.  
  
OUCH!  
  
  
For this well-known (trivial, easy to avoid, easy to detect and  
easy to fix) beginner's error see  
<https://capec.mitre.org/data/definitions/471.html>,  
<https://technet.microsoft.com/en-us/library/2269637.aspx>,  
<https://msdn.microsoft.com/en-us/library/ff919712.aspx> and  
<https://msdn.microsoft.com/en-us/library/ms682586.aspx> plus  
<http://blogs.technet.com/b/srd/archive/2014/05/13/load-library-safely.aspx>  
  
  
Additionally: ZASPSetupWeb_141_011_000.exe and  
zafwSetupWeb_141_011_000.exe create the UNSAFE temporary directory  
%TEMP%\{907A1104-E812-4b5c-959B-E4DAB37A96AB} to unpack their  
payload and download other executables, including your real  
executable installer install.exe, which has but the same bugs!  
  
  
Proof of concept (verified on Windows XP, Windows Vista, Windows 7,  
Windows Server 2008 [R2]; should work on newer versions too):  
  
4. create the directory %TEMP%\{907A1104-E812-4b5c-959B-E4DAB37A96AB};  
  
5. copy UXTheme.dll and WindowsCodecs.dll downloaded in step 1  
above into this empty directory;  
for a denial of service copy it as PowrProf.dll, WebIO.dll,  
WinHttp.dll, Version.dll and MSWSock.dll (or create your own  
DLL which exports the referenced entries to have them loaded  
and executed too);  
  
6. run ZASPSetupWeb_141_011_000.exe and/or   
zafwSetupWeb_141_011_000.exe from step 3 above.  
  
PWNED! resp. DOSSED!  
  
  
For this well-known (trivial, easy to avoid, easy to detect and  
easy to fix) beginner's error see  
<https://cwe.mitre.org/data/definitions/377.html>,  
<https://cwe.mitre.org/data/definitions/379.html>,  
<https://capec.mitre.org/data/definitions/27.html>,  
<https://capec.mitre.org/data/definitions/29.html> ...  
  
  
See <http://seclists.org/fulldisclosure/2015/Nov/101>,  
<http://seclists.org/fulldisclosure/2015/Dec/86> and  
<http://seclists.org/fulldisclosure/2015/Dec/121> plus  
<http://home.arcor.de/skanthak/sentinel.html> and the still unfinished  
<http://home.arcor.de/skanthak/!execute.html> for more details and why  
executable installers (and self-extractors too) are bad and should be  
dumped.  
  
  
stay tuned  
Stefan Kanthak  
  
  
PS: I really LOVE (security) software with such trivial beginner's  
errors. It's a tell-tale sign to stay away from this crapware!  
  
  
Timeline:  
~~~~~~~~~  
  
2015-12-13 report sent to vendor  
  
NO ANSWER, not even an acknowledgement of receipt  
  
2015-12-23 reports resent to vendor  
  
NO ANSWER, not even an acknowledgement of receipt  
  
2016-01-01 reports resent to vendor  
  
NO ANSWER, not even an acknowledgement of receipt  
  
2016-01-07 report published  
`