Home page logo
/

bugtraq logo Bugtraq mailing list archives

Privilege Escalation through Binary Planting in Panda Internet Security
From: by_argos () hotmail com
Date: Mon, 3 Dec 2012 20:49:10 GMT

========================================================================
Privilege Escalation through Binary Planting in Panda Internet Security
========================================================================

Software: Panda Internet Security 2012 & 2013
Vendor: http://www.pandasecurity.com/
Vuln Type: Binary Planting Attack
Remote: No
Local: Yes
Discovered by: QSecure and Demetris Papapetrou
Website: http://www.qsecure.com.cy
Discovered: 09/09/2012
Reported: 19/11/2012
Disclosed: 04/12/2012
Vendor's Response: Automatically Generated Email
Vulnerability Reference: http://www.qsecure.com.cy/advisories/binary_planting_in_panda.html

VULNERABILITY DESCRIPTION:
==========================
As a result of an incorrect dynamic link library (DLL) loading in Panda Internet Security, an attacker with user level 
access to the machine can elevate 

his/her privileges to SYSTEM.

This can be accomplished by planting a malicious DLL file in a writable folder that is part of the system's %PATH% 
variable. The malicious DLL is loaded when 

the vulnerable Panda service or the system is restarted.

The following DLLs are insecurely loaded by Panda Internet Security 2013:

Insecure DLL    Vulnerable Service
-------------   ------------------
Pavshld.dll     PsCtrls.exe, PsImSvc.exe, PavFnSvr.exe, PskSvc.exe
ImFilter.dll2   PsImSvc.exe
ImFilter.dll3   PsImSvc.exe
ImFilter.dll4   PsImSvc.exe

In addition to the above DLLs, Panda Internet Security 2012 also loads ham.dll insecurely.


  By Date           By Thread  

Current thread:
  • Privilege Escalation through Binary Planting in Panda Internet Security by_argos (Dec 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]