Kaspersky Antivirus Code Injection

`Hello Bugtraq.  
  
I write to notify a vulnerability in Kaspersky Antivirus that allows  
the code injection in the process that is executed in user's context,  
allowing:  
  
1. The modification, creation and elimination of the values and keys  
in the Registration with respect to the configuration of the  
antivirus.  
  
2. The modification, creation and elimination of folders and files in  
the installation directory protected by this.  
  
The versions in which this vulnerability has been proven have been the  
following ones:  
  
4.0.9.0  
5.0.712  
6.0.2.690  
6.0.3.837  
  
The version 6.0.4.1217, it detects and it refuses the intrusion; the  
version 7.0.1.325 don't detect the intrusion but it doesn't execute  
the exploit.  
  
The code injection is possible from an user restricted with minimum privileges  
  
The vulnerability this related with Pro-active Defense, specifically  
in the event of Sub-control of Windows, which controls the  
installation of hooks among applications; this for defect comes  
disabled when installing the antivirus allowing this breach of  
security, because it is not verified on the part of the protection.  
  
The vulnerability can be mitigated activating the event of Sub-control  
of Windows.  
  
The exploit is simple:  
  
1. To obtain the one identifies of a thread associated to a window of  
the antivirus, by means of the function GetWindowThreadProcessId ().  
  
ThId=GetWindowThreadProcessId (hWnd, & Pid);  
  
2. To install the hook by means of the function SetWindowsHookEx  
associated to our dll.  
  
hHook=SetWindowsHookEx (WH_GETMESSAGE, HookProc, hMod, ThId);  
  
3. And to send a message to the window for the activation of the installed hook.  
  
SendMessage (hWnd, WM_SETFOCUS,0,0);  
  
  
The vulnerability was notified to Kaspersky Lab the January 20 2010.  
`