Exploit-DB #30374
Description: QuickHeal AntiVirus 7.0.0.1 - Local Stack Overflow
Type: local
Platform: windows
Date: 2013-12-17
Author: Arash Allebrahim

Exploit:
Document Title:
===============
QuickHeal AntiVirus 7.0.0.1 - Stack Overflow Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1171

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6767

CVE-ID:
=====
CVE-2013-6767


Release Date:
=============
2013-12-16


Vulnerability Laboratory ID (VL-ID):
====================================
1171


Common Vulnerability Scoring System:
====================================
5.6


Product & Service Introduction:
===============================
The simple interface and best virus protection technology of Quick Heal AntiVirus Pro ensures complete security without interrupting 
or slowing down your system. Real time cloud security restricts access to malware infected websites. Spam filters stop phishing and 
infected emails from reaching your inbox. Uninterrupted PC usage and viewing without prompts. 

Quick Heal Anti-Virus is an all-round antivirus and security tool aimed at the intermediate home user. On first appearances, Quick Heal 
Anti-Virus doesn’t do well. Installation is complicated, and the initial window that shows up is not, in fact, the main interface. Once 
you find your way back to the control center, however, things become much clearer.

Visually, Quick Heal Anti-Virus is fairly successful. It has a nice, if not revolutionary, interface and all the sections are easy 
to navigate. It also has a good selection of configuration options, where you can customize everything from what behavior the program 
takes when it finds a virus to setting a password so nobody can change your configurations.

(Copy of the Homepage: http://www.quickheal.com/download-free-antivirus )


Abstract Advisory Information:
==============================
An independent laboratory researcher discovered a local stack buffer overflow vulnerability in the official QuickHeal AntiVirus 7.0.0.1 (b2.0.0.1) Pro software.


Vulnerability Disclosure Timeline:
==================================
2013-12-16:    Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Quick Heal Technologies (P) Ltd
Product: QuickHeal AntiVirus - Software 7.0.0.1 (build 2.0.0.1 - 2.0.0.0)


Exploitation Technique:
=======================
Local


Severity Level:
===============
Medium


Technical Details & Description:
================================
A local stack buffer overflow vulnerability has been discovered in the official QuickHeal AntiVirus 7.0.0.1 (b2.0.0.1) Pro software.
The vulnerability allows local low privileged user accounts to compromise the system by a classic stack overflow issue. 

QuickHeal Antivirus suffers from improper handling of buffers in it`s `pepoly.dll` module on certain conditions which leads 
to a stack overflow. Upon disabling `Core scanning server` service, the vulnerable point could be triggered & crash the system. 
Just run the PoC & once you see properties dialog, change your tab from `General` to `QuickHeal`. This will cause the QuickHeal 
to scan your file & reports back to you the file status (whether it`s infected or clean). It`s notable that, in normal conditions 
I was unable to trigger the vulnerability, & this is what`s the reason why I inject a dll into `explorer.exe` to trigger the bug 
in right manner.

The vulnerability is located in the generated PE file `*.text` value. Local attackers are able to overflow the process by a 
manipulated import of a malicious PE file. The issue is a classic (uni-code) stack buffer overflow. Local attackers can overwrite 
the registers to compromise the system or crash the quickheal software system process. The security risk of the local stack buffer 
overflow vulnerability is estimated as medium(+) with a cvss (common vulnerability scoring system) count of 5.6(+)|(-)5.7.

The vulnerability can be exploited by local attackers with low privileged system user account and without user interaction. 
Successful exploitation of the local stack buffer overflow software vulnerability results in process- and system compromise. 


Proof of Concept (PoC):
=======================
The local stack buffer overflow vulnerability can be exploited by local attackers with low privileged system user account and 
without user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below.


--- PoC Debug Logs --- 
eax=000015bc ebx=03f48a0c ecx=03f12a34 edx=03f47a68 esi=089c84e8 edi=00000000
eip=05bab107 esp=03f47a2c ebp=000822d8 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
*** WARNING: Unable to verify checksum for C:\PROGRA~1\QUICKH~1\QUICKH~1\pepoly.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\PROGRA~1\QUICKH~1\QUICKH~1\pepoly.dll - 
pepoly!GetRealTypeByContents+0x297147:
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
05bab107 8501            test    dword ptr [ecx],eax  ds:0023:03f12a34=00000000
0:019> kb
ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
03f47a2c 05b73afa 059342ac 00[PII_REDACTED]22d8 pepoly!GetRealTypeByContents+0x297147
03f47ab0 [PII_REDACTED] [PII_REDACTED] pepoly!GetRealTypeByContents+0x25fb3a
03f47ab4 [PII_REDACTED] [PII_REDACTED] <Unloaded_Res.dll>+0x41414110
03f47ab8 [PII_REDACTED] [PII_REDACTED] <Unloaded_Res.dll>+0x41414110
03f47abc [PII_REDACTED] [PII_REDACTED] <Unloaded_Res.dll>+0x41414110
03f47ac0 [PII_REDACTED] [PII_REDACTED] <Unloaded_Res.dll>+0x41414110
03f47ac4 [PII_REDACTED] [PII_REDACTED] <Unloaded_Res.dll>+0x41414110
03f47ac8 [PII_REDACTED] [PII_REDACTED] <Unloaded_Res.dll>+0x41414110
03f47a