<<< Date Index >>>     <<< Thread Index >>>

Errata: [TZO-2009-1] Avira Antivir - RAR - Division by Zero & Null Pointer Dereference



Errata :

Products listed but not affected :
AVIRA WebProtector for KEN! - Reason: Does not use the Scan Engine
Avira AntiVir Mobile - Reason: Does not use the same AV Engine

Avira requested the following products to be removed from the list,
for the reason that they are license models and not products per se,
it is arguable whether they should be listed or not, since the
licenses (most likely) include the vulnerable products:

AVIRA WebGate Suite - Reason: is a License Model
AVIRA SmallBusiness Suite -> Reason: is a License Model
AVIRA Business Bundle -> Reason: is a License Model
AVIRA AntiVir NetWork Bundle -> Reason: is a License Model
AVIRA AntiVir NetGate Bundle -> Reason: is a License Model
AVIRA AntiVir GateWay Bundle -> Reason: is a License Model
AVIRA AntiVir Campus (for Education) -> Reason: is a License Model

List of undisputed affected products :

Avira Antivr Free
Avira AntiVir Premium
Avira Premium Security Suite
Avira AntiVir Professional
Avira AntiVir for KEN! 4
Avira AntiVir SharePoint
Avira AntiVir Virus Scan Adapter for SAP NetWeaverŽ
Avira AntiVir MailGate
Avira MailGate Suite
Avira AntiVir Exchange
Avira AntiVir MIMEsweeper
Avira AntiVir Domino
Avira AntiVir WebGate
Avira WebGate Suite
Avira AntiVir ISA Server
Avira AntiVir MIMEsweeper



______________________________________________________________________

     Avira - RAR -Division by Zero & Null Pointer Dereference
______________________________________________________________________

Reference     : [TZO-2009-1]-Avira Antivir
Location      : 
http://blog.zoller.lu/2009/01/advisory-tzo-2009-1-avira-antivir-rar.html
Products      : Avira Antivr Free
                Avira AntiVir Premium
                Avira Premium Security Suite
                Avira AntiVir Professional
                Avira AntiVir for KEN! 4
                Avira AntiVir SharePoint
                Avira AntiVir Virus Scan Adapter for SAP NetWeaverŽ
                Avira AntiVir MailGate
                Avira MailGate Suite
                Avira AntiVir Exchange
                Avira AntiVir MIMEsweeper
                Avira AntiVir Domino
                Avira AntiVir WebGate
                Avira WebGate Suite
                Avira AntiVir ISA Server
                Avira AntiVir MIMEsweeper
                                
Vendors and Products using the Avira Engine :
Important : The impact of this flaw on those devices  has  not  been
tested nor confirmed to exist, there is however  reason  to  believe
that    the    flaw    existed    in    this    products     aswell.

http://www.avira.com/documents/utils/pdf/products/pi_system-integration_en.pdf

               AXIGEN Mail Server
               Clearswift Mimesweeper
               GeNUGate and GeNUGate Pro (optional addon)
               IQ.Suite                 

Vendor        : http://www.avira.de



I. Background
~~~~~~~~~~~~~
Avira is a leading worldwide provider of  self-developed  protection
solutions for professional and private use. The company  belongs  to
the pioneers in this  sector  with  over  twenty  years  experience.

The protection experts have numerous  company  locations  throughout
Germany and cultivate partnerships in  Europe,   Asia  and  America.
Avira has more than 180 employees at their main office  in  Tettnang
near Lake Constance and is one  of  the  largest  employers  in  the
region.  There  are  around  250  people  employed  worldwide  whose
commitment is continually being confirmed by awards.  A  significant
contribution to protection is the Avira AntiVir  Personal  which  is
being  used  by   private    users    a    million    times    over.

AV-Comparatives e.V.  have  chosen  Avira  AntiVir  Premium  as  the
best anti-virus solution of 2008 

II. Description
~~~~~~~~~~~~~~~
By manipulating certain fields inside a  RAR  archive  and  attacker
might trigger division by zero and null point exceptions. The attack vector  
should  be  rated as  remote  as  an  attachement  to    an    e-mail    is    
enough.

*Anybody  else  noticed  that  the  amount  of  details   in    most
advisories have *become less than usefull ?*


III. Impact
~~~~~~~~~~~~~~~
In some cases the  impact  is  a  Denial  of  Service  condition  in
others to an invalid read size  of  4  bytes  which  again  in  some
cases lead to an null pointer dereference.

The RAR parser inside the  module  leads  to  various  errors  whose
exploitability index is rated "I don't have time for this now  -  so
let's say 'maybe'" also sometimes known as "I lack the  time  and/or
the skill to do so". 


FAULTING_IP: 
aepack!module_get_api+20ed9
0131cad9 8b10            mov     edx,dword ptr [eax]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0131cad9 (aepack!module_get_api+0x00020ed9)
   ExceptionCode: c0000005 (Access violation)
   ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000268
Attempt to read from address 00000268

FAULTING_THREAD:  00000144
DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

PROCESS_NAME:  avscan.exe
OVERLAPPED_MODULE: Address regions for 'AVREP' and 'rcimage.dll' overlap

READ_ADDRESS:  00000268 
BUGCHECK_STR:  
APPLICATION_FAULT_INVALID_POINTER_READ_CORRUPT_MODULELIST_OVERLAPPED_MODULE
LAST_CONTROL_TRANSFER:  from 0131cb8c to 0131cad9

STACK_TEXT:  

0194f5fc 0131cb8c 0115bbfc 00000003 00000100 aepack!module_get_api+0x20ed9
0194f618 01319b96 0115bbfc 074cc4f4 00000002 aepack!module_get_api+0x20f8c
0194f654 0131a45a 00000010 01157160 00000001 aepack!module_get_api+0x1df96
0194f668 0131e7e0 000000d4 00f48ba8 011530d0 aepack!module_get_api+0x1e85a
0194f68c 01318c35 01157160 00000010 011530d0 aepack!module_get_api+0x22be0
00000000 00000000 00000000 00000000 00000000 aepack!module_get_api+0x1d035

FOLLOWUP_IP: 
aepack!module_get_api+20ed9
0131cad9 8b10            mov     edx,dword ptr [eax]

SYMBOL_NAME:  aepack!module_get_api+20ed9
MODULE_NAME: aepack
IMAGE_NAME:  aepack.dll
STACK_COMMAND:  ~2s ; kb

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_aepack.dll!module_get_api
BUCKET_ID:  
APPLICATION_FAULT_INVALID_POINTER_READ_CORRUPT_MODULELIST_OVERLAPPED_MODULE_aepack!module_get_api+20ed9


IV. Disclosure Timeline
~~~~~~~~~~~~~~~~~~~~~~~~
The    Vulnerability    notification    policy    i    adhere    to:
http://blog.zoller.lu/search/label/Vulnerability%20disclosure%20Policy

 
17/12/2008  :  Sent  notice   to    the    correct    mail    adress
security@avira. com

17/12/2008 : Avira achknowledges receipt 

17/12/2008 : Avira sends details of  the  root  cause  on  the  same
day "The  crash  occurs  in  a  heavily  corrupted,   generated  RAR
archive while extracting the contents of the 22nd  file.   We  can't
give  any  file  names  as  they  are  non-printable  characters.  "

13/01/2009 : Avira notifies me that the  issue  was  fixed  with  an
update that shipped with AVPack 8.1.3.5  on  the  09/01/2009

14/01/2009 : Avira states  that  all  products  have  been  affected
except  "Securityy  Management  Center"  and  the  "Internet  Update
Manager". "Das bedeutet im Prinzip wirklich alle  Produkte,   ausser
Produkte wie eben das Security Management Center oder  der  Internet
Update Manager"

14/01/2009 : Release of this advisory 


Thierry Zoller
http://blog.zoller.lu