Comodo DLL Hijacking

`Hi @ll,  
  
the executable installers cispro_30day_installer_1150_8d.exe,  
cispremium_installer_6100_08.exe, cav_installer_5951_60.exe,  
cav_installer.exe and cfw_installer.exe available from  
<http://www.comodo.com> load and execute several DLLs from  
their "application directory".  
  
For software downloaded with a web browser the application  
directory is typically the user's "Downloads" directory: see  
<https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html>,  
<http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html>  
and <http://seclists.org/fulldisclosure/2012/Aug/134>  
  
  
If an attacker places one of these DLLs in the users "Downloads"  
directory (for example per drive-by download or social engineering)  
this vulnerability becomes a remote code execution.  
  
Due to the application manifest embedded in the executables which  
specifies "requireAdministrator" the executable installer is run  
with administrative privileges ("protected" administrators are  
prompted for consent, unprivileged standard users are prompted for  
an administrator password); execution of the DLLs therefore results  
in an escalation of privilege!  
  
  
Proof of concept/demonstration:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
1. visit <http://home.arcor.de/skanthak/sentinel.html>, download  
<http://home.arcor.de/skanthak/download/SENTINEL.DLL> and save  
it as UXTheme.dll in your "Downloads" directory, then copy it  
as DWMAPI.dll, RichEd20.dll, ClbCatQ.dll and ProfAPI.dll;  
  
2. download any of the executable installers provided by Comodo  
and save them in your "Downloads" directory;  
  
3. run the executable installers from the "Downloads" directory;  
  
4. notice the message boxes displayed from the DLLs placed in  
step 1.  
  
PWNED!  
  
  
See <http://seclists.org/fulldisclosure/2015/Nov/101> and  
<http://seclists.org/fulldisclosure/2015/Dec/86> as well as  
<http://home.arcor.de/skanthak/!execute.html> and  
<http://home.arcor.de/skanthak/sentinel.html> for details about  
this well-known and well-documented BEGINNER'S error!  
  
  
stay tuned  
Stefan Kanthak  
  
  
PS: I really LOVE (security) software with such trivial beginner's  
errors. It's a tell-tale sign to better stay away from it!  
  
  
Timeline:  
~~~~~~~~~  
  
2016-01-21 sent report to vendor  
  
NO ANSWER, not even an acknowledgement of receipt  
  
2016-01-28 resent report to vendor  
  
2016-01-28 Vendor acknowledges receipt  
  
2016-02-29 Vendor informs:  
"update ready, schedule for release during the week of  
March 14"  
  
2016-03-22 Vendor releases updates; see the release notes  
<https://cdn.download.comodo.com/cis/download/installs/updates/release/inis_4055/release_notes.html>  
  
  
`