BitDefender Internet Security 2011 - Pointer Vulnerability

Document Title:
===============
BitDefender Internet Security 2011 - Pointer Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=149


Release Date:
=============
2012-01-26


Vulnerability Laboratory ID (VL-ID):
====================================
149


Product & Service Introduction:
===============================
BitDefender Internet Security 2010 schützt die Online-Aktivitäten Ihrer Familie -ohne die PCs auszubremsen. 
Es versperrt Viren, Hackern und Spam den Zutritt und bietet Schutz durch Kindersicherung und Firewall.

(Copy of the Vendor Homepage: http://www.bitdefender.com/)


Abstract Advisory Information:
==============================
Vulnerability-Lab Team discovered a critical Pointer Vulnerability on BitDefender Internet Security 2011.


Vulnerability Disclosure Timeline:
==================================
2011-04-12:	Vendor Notification
2011-**-**:	Vendor Response/Feedback
2011-**-**:	Vendor Fix/Patch
2012-01-27:	Public or Non-Public Disclosure


Discovery Status:
=================
Published


Affected Product(s):
====================

Exploitation Technique:
=======================
Local


Severity Level:
===============
Medium


Technical Details & Description:
================================
A Pointer vulnerability is detected on Bitdefenders Internet Security Suite 2011. A local attacker can crash the running software 
proccess(bdtkexec.exe) via a invalid pointer read misconfiguration. The vulnerability allows an attacker to crash the software process 
stable after a combined apphang on a main module. The bug is located in the tune-up quick bar menu when a module on the bar hangs.

Vulnerable Section: 
			                            [+] Tune UP

Vulnerable Module(s):
			                            [+] bdtkexec.exe


Proof of Concept (PoC):
=======================
The vulnerability can be exploited by local attackers. For demonstration or reproduce ...

--- Exception Logs ---
The stored exception information can be accessed via .ecxr.
(1798.230): Access violation - code c0000005 (first/second chance not available)

.exr 0xffffffffffffffff
ExceptionAddress: 000007fefd6c28fa (ole32+0x00000000000328fa)
   ExceptionCode: c0000005 (Access violation)

Stack-Text(Cut):
00000000`0012f790 00000000`0021afd8 : 00000011`25000124 00000000`02fe0230 00000fff`ff000000 00000000`00000001 : ole32+0x328fa
00000000`0012f798 00000011`25000124 : 00000000`02fe0230 00000fff`ff000000 00000000`00000001 000007fe`fd6c2748 : 0x21afd8
00000000`0012f7a0 00000000`02fe0230 : 00000fff`ff000000 00000000`00000001 000007fe`fd6c2748 00000005`00000004 : 0x11`25000124
00000000`0012f7a8 00000fff`ff000000 : 00000000`00000001 000007fe`fd6c2748 00000005`00000004 00000000`00000000 : 0x2fe0230
00000000`0012f7b0 00000000`00000001 : 000007fe`fd6c2748 00000005`00000004 00000000`00000000 00000000`04830720 : 0xfff`ff000000
00000000`0012f7b8 000007fe`fd6c2748 : 00000005`00000004 00000000`00000000 00000000`04830720 00000000`0022f6b0 : 0x1
00000000`0012f7c0 00000005`00000004 : 00000000`00000000 00000000`04830720 00000000`0022f6b0 00000000`0020d820 : ole32+0x32748
00000000`0012f7c8 00000000`00000000 : 00000000`04830720 00000000`0022f6b0 00000000`0020d820 00000000`00000000 : 0x5`00000004


Debug Log(Cut):
FAULTING_IP: 
ole32+328fa
000007fe`fd6c28fa 488b01          mov     rax,qword ptr [rcx]

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fefd6c28fa (ole32+0x00000000000328fa)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000004830720
Attempt to read from address 0000000004830720

PROCESS_NAME:  bdtkexec.exe

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: ole32

FAULTING_MODULE: 0000000077290000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5be01a

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000004830720

READ_ADDRESS:  0000000004830720 

FOLLOWUP_IP: 
ole32+328fa
000007fe`fd6c28fa 488b01          mov     rax,qword ptr [rcx]

FAULTING_THREAD:  0000000000000230

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_WRONG_SYMBOLS

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

IP_ON_HEAP:  000000000021afd8
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER:  from 000000000021afd8 to 000007fefd6c28fa




Analyses:
			../Analyse/Report.wer
			../Analyse/WER31AD.tmp.WERInternalMetadata.xml
			../Analyse/WER31FC.tmp.hdmp
			../Analyse/WER2167.tmp.appcompat.txt
			../Analyse/WER3557.tmp.mdmp


Manually reproduce ...

1. Try to simulate an app-hang over a specific process in the tune-up quick bar
2. On the app-hang try to configure the quick tune-up menu
3. Enjoy the pointer bug on reading ...

Information: 	Get sure that the process is connected through the structure with the tune-up ... 
		Successfully exploitation requires a bound module apphand on processing.


Reference(s):
			../Analyse/AppCrash_bdtkexec.exe_402f4b56824685dd788ced57f1351281d724b9_cab_0ca437a5
			../Analyse/AppCrash_bdfvcl.exe_c8126bc070dce08b638651451ee988a22a0e62a_cab_1501a968


Security Risk:
==============
The security risk of the pointer vulnerability is estimated as medium(+).


Credits & Authors:
==================
Vulnerability Research Laboratory  -   N/A   Anonymous


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory