Comodo Antivirus - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated programs CreateFile...

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=762 In COleMemFile::LoadDiFatList, values from the header are used to parse the document FAT. If header.csectDif is very high, the calculation overflows...

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=762 In COleMemFile::LoadDiFatList, values from the header are used to parse the document FAT. If header.csectDif is very high, the calculation overflows and a very small buffer is...

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=762 In COleMemFile::LoadDiFatList, values from the header are used to parse the document FAT. If header.csectDif is very high, the calculation overflows and a very small buffer is allocated. The document FAT is then memcpy'd onto t...

Comodo - PackMan Unpacker Insufficient Parameter Validation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=764 Packman is an obscure opensource executable packer that Comodo Antivirus attempts to unpack during scanning. The code is available online here: http://packmanpacker.sourceforge.net/ If the compression method is set to algorithm...

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated...

Avira - Heap Underflow Parsing PE Section Headers

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=765 One of the things you might expect an Antivirus engine to do reliably is parse PE files. However, after some simple testing with Avira, I found a heap underflow that is, writin...

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated programs CreateFile, LoadLibrary, etc. The emulator itself is located ...

Comodo - LZMA Decoder Heap Overflow via Insufficient Parameter Checks

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=763 The LZMA specification says the following about the memory usage of decompression: "The size of the probability model counter arrays is calculated with the following formula: sizeofprobarrays = 1846 + 768 1 r rax=00000000000004...

Avast! - Heap Overflow Unpacking MoleBox Archives

Avast! - Heap Overflow Unpacking MoleBox Archives Source: https://code.google.com/p/google-security-research/issues/detail?id=552 Trivial fuzzing of molebox archives revealed a heap overflow decrypting the packed image in moleboxMaybeUnpack. This vulnerability is obviously exploitable for remote...

Kaspersky AntiVirus - '.DEX' File Format Memory Corruption

Source: https://code.google.com/p/google-security-research/issues/detail?id=529 The attached testcase was found by fuzzing DEX files, and results in a heap overflow with a wild memcpy. Note that Kaspersky catch exceptions and continue execution, so running into unmapped pages doesn't terminate th...

ManageEngine Desktop Central Tools Execution Status Update RCE (intrusive check)

The version of ManageEngine Desktop Central running on the remote host is affected by an unspecified remote code execution vulnerability in the system tools execution status updates due to a failure to properly sanitize user-supplied input. A remote, unauthenticated attacker can exploit this to...

(0Day) SolarWinds Server and Application Monitor Alert Manager Elevation of Privilege Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of SolarWinds Server and Application Monitor. This vulnerability requires the attacker to have an unprivileged account on the system. The specific flaw exists within the Alert Manager component. Alerts withi...

Kaspersky AntiVirus - UPX Parsing Memory Corruption

Kaspersky AntiVirus - UPX Parsing Memory Corruption Source: https://code.google.com/p/google-security-research/issues/detail?id=527 While fuzzing UPX packed files, this crash was discovered resulting in an arbitrary stack-relative write. This vulnerability is obviously remotely exploitable for...

Kaspersky AntiVirus - '.DEX' File Format Parsing Memory Corruption

Source: https://code.google.com/p/google-security-research/issues/detail?id=519 Fuzzing the DEX file format found a crash that loads a function pointer from an attacker controlled pointer, on Windows this results in a call to an unmapped address. This is obviously exploitable for remote,...

Kaspersky AntiVirus - Yoda's Protector Unpacking Memory Corruption

Source: https://code.google.com/p/google-security-research/issues/detail?id=528 The attached testcase was found by fuzzing packed PE files, I suspect it was packed using "Yoda's protector". This vulnerability is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM on all systems...

Kaspersky AntiVirus - .DEX File Format Parsing Memory Corruption

Kaspersky AntiVirus - .DEX File Format Parsing Memory Corruption Source: https://code.google.com/p/google-security-research/issues/detail?id=519 Fuzzing the DEX file format found a crash that loads a function pointer from an attacker controlled pointer, on Windows this results in a call to an...

Symantec Endpoint Protection Manager - Authentication Bypass / Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Symantec Endpoint Protection Manager Authentication Bypass and Code Execution', 'Description' = %q This module exploits three separa...

Symantec Endpoint Protection Manager Authentication Bypass / Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Symantec Endpoint Protection Manager Authentication Bypass and Code Execution', 'Description' = %q This module exploits three separa...

ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)

The version of ManageEngine Desktop Central running on the remote host is affected by a remote code execution vulnerability due to a failure by the statusUpdate script to properly sanitize user-supplied input to the 'fileName' parameter when performing an 'LFU' action to statusUpdate. A remote,...