Unvalidated Compression Parameters in Packman

vendor:

Comodo Antivirus

by:

Project Zero

9.8

CVSS

CRITICAL

Memory Corruption

119

CWE

Product Name: Comodo Antivirus

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Unvalidated Compression Parameters in Packman

The Comodo Antivirus attempts to unpack the Packman executable packer. If the compression method is set to algorithm 1, compression parameters are read directly from the input executable without validation. This leads to various crashes and allows an attacker to free an arbitrary pointer, leading to code execution as NT AUTHORITYSYSTEM.

Mitigation:

To mitigate this vulnerability, it is recommended to update the Comodo Antivirus software to the latest version or consider using an alternative antivirus solution.

Source

Exploit-DB raw data:

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=764

Packman is an obscure opensource executable packer that Comodo Antivirus attempts to unpack during scanning. The code is available online here:

http://packmanpacker.sourceforge.net/

If the compression method is set to algorithm 1, compression parameters are read directly from the input executable without validation. Fuzzing this unpacker revealed a variety of crashes due to this, such as causing pointer arithmetic in CAEPACKManUnpack::DoUnpack_With_NormalPack to move pksDeCodeBuffer.ptr to an arbitrary address, which allows an attacker to free() an arbitrary pointer.

This issue is obviously exploitable to execute code as NT AUTHORITY\SYSTEM.

The attached testcase will attempt to free() an invalid pointer to demonstrate this.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39601.zip