Comodo DLL Hijacking
Posted on 24 March 2016
Hi @ll, the executable installers cispro_30day_installer_1150_8d.exe, cispremium_installer_6100_08.exe, cav_installer_5951_60.exe, cav_installer.exe and cfw_installer.exe available from <http://www.comodo.com> load and execute several DLLs from their "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see <https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html>, <http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html> and <http://seclists.org/fulldisclosure/2012/Aug/134> If an attacker places one of these DLLs in the users "Downloads" directory (for example per drive-by download or social engineering) this vulnerability becomes a remote code execution. Due to the application manifest embedded in the executables which specifies "requireAdministrator" the executable installer is run with administrative privileges ("protected" administrators are prompted for consent, unprivileged standard users are prompted for an administrator password); execution of the DLLs therefore results in an escalation of privilege! Proof of concept/demonstration: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1. visit <http://home.arcor.de/skanthak/sentinel.html>, download <http://home.arcor.de/skanthak/download/SENTINEL.DLL> and save it as UXTheme.dll in your "Downloads" directory, then copy it as DWMAPI.dll, RichEd20.dll, ClbCatQ.dll and ProfAPI.dll; 2. download any of the executable installers provided by Comodo and save them in your "Downloads" directory; 3. run the executable installers from the "Downloads" directory; 4. notice the message boxes displayed from the DLLs placed in step 1. PWNED! See <http://seclists.org/fulldisclosure/2015/Nov/101> and <http://seclists.org/fulldisclosure/2015/Dec/86> as well as <http://home.arcor.de/skanthak/!execute.html> and <http://home.arcor.de/skanthak/sentinel.html> for details about this well-known and well-documented BEGINNER'S error! stay tuned Stefan Kanthak PS: I really LOVE (security) software with such trivial beginner's errors. It's a tell-tale sign to better stay away from it! Timeline: ~~~~~~~~~ 2016-01-21 sent report to vendor NO ANSWER, not even an acknowledgement of receipt 2016-01-28 resent report to vendor 2016-01-28 Vendor acknowledges receipt 2016-02-29 Vendor informs: "update ready, schedule for release during the week of March 14" 2016-03-22 Vendor releases updates; see the release notes <https://cdn.download.comodo.com/cis/download/installs/updates/release/inis_4055/release_notes.html>
