Exploit-DB #36476
Description: Kaspersky Internet Security/Anti-Virus - '.cfg' File Memory Corruption
Type: local
Platform: windows
Date: 2011-12-21
Author: Vulnerability Research Laboratory

Exploit:
source: https://www.securityfocus.com/bid/51161/info

Kaspersky Internet Security and Anti-Virus are prone to a local memory-corruption vulnerability.

A local attacker can exploit this issue to cause the affected application to crash, denying service to legitimate users. Due to the nature of this issue, arbitrary code execution may be possible; this has not been confirmed. 

Title:
======
Kaspersky IS&AV 2011/12 - Memory Corruption Vulnerability


Date:
=====
2011-12-19


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=129


VL-ID:
=====
129


Introduction:
=============
Kaspersky Internet Security 2011 has everything that you need to stay safe and secure while you re surfing the web. 
It provides constant protection for you and your family – whether you work, bank, shop or play online.

Kaspersky Anti-Virus 2011 – the backbone of your PC’s security system, offering real-time automated protection from 
a range of IT threats. Kaspersky Anti-Virus 2011 provides the basic tools needed to protect your PC. Our award-winning 
technologies work silently in the background while you enjoy your digital life.

(Copy of Vendor Homepage: http://www.kaspersky.com/kaspersky_anti-virus  &&  http://www.kaspersky.com/kaspersky_internet_security)


Abstract:
=========
Vulnerability-Lab Team discovered a Memory & Pointer Corruption Vulnerability on Kaspersky Internet Security 2011/2012 & Kaspersky Anti-Virus 2011/2012.


Report-Timeline:
================
2010-12-04:	Vendor Notification
2011-01-16:	Vendor Response/Feedback
2011-12-19:	Public or Non-Public Disclosure


Status:
========
Published


Affected Products:
==================

Exploitation-Technique:
=======================
Local


Severity:
=========
Medium


Details:
========
A Memory Corruption vulnerability is detected on Kaspersky Internet Security 2011/2012 &  Kaspersky Anti-Virus 2011/2012. 
The vulnerability is caused by an invalid pointer corruption when processing a corrupt .cfg file through the kaspersky exception filters, 
which could be exploited by attackers to crash he complete software process. 
The bug is located over the basegui.ppl & basegui.dll when processing a .cfg file import.


Vulnerable Modules: 

			[+] CFG IMPORT


Affected Version(s):
Kaspersky Anti-Virus 2012 & Kaspersky Internet Security 2012
KIS 2012 v12.0.0.374
KAV 2012 v12.x

Kaspersky Anti-Virus 2011 & Kaspersky Internet Security 2011
KIS 2011 v11.0.0.232 (a.b)
KAV 11.0.0.400
KIS 2011 v12.0.0.374

Kaspersky Anti-Virus 2010 & Kaspersky Internet Security 2010


--- Kaspersky Bug Logs ---

Folder:                  ../Analyses/Crash Reports (KIS&KAV)

KAV.11.0.0.232_08.04_22.24_3620.GUI.full.dmp
KAV.11.0.0.232_08.04_22.24_3620.GUI.mini.dmp
KAV.11.0.0.232_08.04_22.24_3620.GUI.tiny.dmp

KAV.11.0.0.232_08.04_22.28_2956.GUI.full.dmp
KAV.11.0.0.232_08.04_22.28_2956.GUI.mini.dmp
KAV.11.0.0.232_08.04_22.28_2956.GUI.tiny.dmp

KAV.11.0.0.232?_08.04_23.21_3712.GUI.full.dmp
KAV.11.0.0.232?_08.04_23.21_3712.GUI.mini.dmp
KAV.11.0.0.232?_08.04_23.21_3712.GUI.tiny.dmp

KAV.11.0.0.232?_08.04_23.54_2640.GUI.full.dmp
KAV.11.0.0.232?_08.04_23.54_2640.GUI.mini.dmp
KAV.11.0.0.232?_08.04_23.54_2640.GUI.tiny.dmp

Reference(s): 
				../Analyses/Crash Reports (KIS&KAV)/kav_x32.rar
				../Analyses/Crash Reports (KIS&KAV)/kis_x32-win7.zip
				../Analyses/Crash Reports (KIS&KAV)/kis_x64.zip

		

--- Service Crash Report Queue Logs ---

Folder: ../Analyses/Crash Reports (Service)

AppCrash_avp.exe_1d98841adaefc9689cba9c4bbd7
AppCrash_avp.exe_434b4962a0ccbccd3c2a6bd5f95
AppCrash_avp.exe_583f849d49fe1a714c9bd02ba4e
AppCrash_avp.exe_5f09d49c257b515e08a6defbf11
AppCrash_avp.exe_69cb355e[PII_REDACTED]6f047a313
AppCrash_avp.exe_69cb355e[PII_REDACTED]6f047a313
AppCrash_avp.exe_a7a7fe58d34d13f0136d933e977
AppCrash_avp.exe_d21fe6df9c207eac2d8c6bcacad
AppCrash_avp.exe_d2c8cf27ba2a3f6ceaad6c44327
AppCrash_avp.exe_ed94bb914e255192b71d1257c19


Version=1
EventType=APPCRASH
EventTime=[PII_REDACTED]3026260
ReportType=2
Consent=1
UploadTime=[PII_REDACTED]0076663
ReportIdentifier=d70927a2-a1d7-11df-81a1-95fa4108d4d6
IntegratorReportIdentifier=d70927a1-a1d7-11df-81a1-95fa4108d4d6
WOW64=1
Response.BucketId=[PII_REDACTED]
Response.BucketTable=1
Response.type=4
Sig[0].Name=Anwendungsname
Sig[0].Value=avp.exe
Sig[1].Name=Anwendungsversion
Sig[1].Value=11.0.1.400
Sig[2].Name=Anwendungszeitstempel
Sig[2].Value=4c2cd011
Sig[3].Name=Fehlermodulname
Sig[3].Value=basegui.ppl
Sig[4].Name=Fehlermodulversion
Sig[4].Value=11.0.1.400
Sig[5].Name=Fehlermodulzeitstempel
Sig[5].Value=4c2cd193
Sig[6].Name=Ausnahmecode
Sig[6].Value=c0000005
Sig[7].Name=Ausnahmeoffset
Sig[7].Value=00079c3c
DynamicSig[1].Name=Betriebsystemversion
DynamicSig[1].Value=6.1.7600.2.0.0.768.3
DynamicSig[2].Name=Gebietsschema-ID
DynamicSig[2].Value=1031
DynamicSig[22].Name=Zusatzinformation 1
DynamicSig[22].Value=0a9e
DynamicSig[23].Name=Zusatzinformation 2
DynamicSig[23].Value=0a9e372d3b4ad19135b953a78882e789
DynamicSig[24].Name=Zusatzinformation 3
DynamicSig[24].Value=0a9e
DynamicSig[25].Name=Zusatzinformation 4
DynamicSig[25].Value=0a9e372d3b4ad19135b953a78882e789
UI[2]=C://Program Files (x86)/Kaspersky Lab/Kaspersky Internet Security 2011/avp.exe
UI[3]=Kaspersky Anti-Virus funktioniert nicht mehr
UI[4]=Windows kann online nach einer Lösung für das Problem suchen und versuchen, das Programm neu zu starten.
UI[5]=Online nach einer Lösung suchen und das Programm neu starten
UI[6]=Später online nach einer Lösung suchen und das Programm schließen
UI[7]=Programm schließen
LoadedModule[0]=C:/Program Files (x86)/Kaspersky Lab/Kaspersky Internet Security 2011/avp.exe
LoadedModule[1]=C://Windows/SysWOW64/ntdll.dll
LoadedModule[2]=C://Windows/syswow64/kernel32.dll
LoadedModule[3]=C:/Windows/syswow64/KERNELBASE.dll
...
...
LoadedModule[148]=C://Windows//SysWOW64//WMVCore.D