nProtect solutions arbitrary file download and execute vulnerability

[Park Gyutae <saintlinu () yahoo co kr>]

--------------------------------------------------------------------------------------------------------

Title:             nProtect:Netizen arbitrary file download and execute vulnerability
                   nProtectPersonal Web Service arbitrary file download and execute vulnerability

Discoverer:        PARK, GYU TAE (saintlinu () null2root org)
                   Neo

Advisory No.:      NRVA05-04
                   NRVA05-05

Critical:          High critical

Impact:            Gain remote user's privilige

Where:             From remote

Operating System:  Windows Only

Solution:          Patched 

Notice:            07. 01. 2005 initiate notify
                   07. 04. 2005 Second notify
                   07. 26. 2005 Patched
                   07. 29. 2005 Disclosure vulnerability

Description: 

The nProtect:Netizen and nProtectPersonal Web Service are an antivirus solutions.
 
It defends user from Internet about well-known hack tools and viruses something

When it need update and patch itself then download from web site such as update.nprotect.net

that time nProtect update program, npdownv.exe, DO NOT CHECK THAT update site URL!!!

We can change URL, update configuration file and so on

But npdownv.exe DO CHECK files that downloaded from update site compressed WITH PASSWORD!!!

this means npdownv.exe already known password for decompress 

I found password in npdownv.exe by REVERSE ENGINEEGERING 

and Neo modified liveup.haz, configuration file

When user accees the phishing page then downloaded trojan from hacker URL

See following detail describe:

EXPLOIT NOT INCLUDED HERE

Related link:
http://www.nprotect.co.kr/service/nProtectPersonal/nprotect/npos/kor/personal_npos.html

--------------------------------------------------------------------------------------------------------

Special thanks for My best group Null@root. 
PS. I'm very sorry for poor my konglish 

 

__________________________________________________
두 유 야후!?
스팸때문에 짜증나세요? 야후! 메일의 스팸 차단 기술로 메일을 보호합니다 
http://mail.yahoo.co.kr

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/