1. ADVISORY INFORMATION
-----------------------
Product: Avira Secure Backup
Vendor URL: www.avira.com
Type: Improper Restriction of Operations within the Bounds of
a Memory Buffer [CWE-119]
Date found: 2013-10-30
Date published: 2013-11-16
CVSSv2 Score: 4,4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVE: CVE-2013-6356
2. CREDITS
----------
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
4. VULNERABILITY DESCRIPTION
----------------------------
A buffer overflow vulnerability has been identified in Avira Secure
Backup v1.0.0.1 Build 3616.
The application loads the values of the Registry Keys
"AutoUpdateDownloadFilename" and "AutoUpdateProgressFilename" from
"HKEY_CURRENT_USER\Software\Avira Secure Backup" on startup but does not
properly validate the length of the fetched values before using them in
the further application context, which leads to a buffer overflow
condition with possible persistent code execution.
The application queries the values via a RegQueryValueExW call and a
fixed buffer pointer (lpData) and a fixed buffer size pointer
(lpcbData). If the input string size is greater than the predefined
size, the application uses a second RegQueryValueExW call with the new
buffer size set to the length of the input string, but reuses the
original buffer pointer (lpData), which has not been resized. This
results in overwriting memory space inlcuding SEH - records.
An attacker needs to force the victim to import an arbitrary .reg file
in order to exploit the vulnerability. Successful exploits can allow
attackers to execute arbitrary code with the privileges of the user
running the application. Failed exploits will result in a
denial-of-service condition. The attack scenario is persistent, because
the code is executed as long as the manipulated values are loaded into
the Registry.
5. DEBUG INFORMATION
--------------------
Call stack of main thread
Address Returns to Procedure / arguments Called
from
0012EB48 77DA6F87 <JMP.&ntdll.memmove> ADVAPI32.77DA6F82
0012EB4C 0012ECBC dest = 0012ECBC
0012EB50 0015760C src = 0015760C
0012EB54 00002712 n = 2712 (10002.)
0012EC28 77DA708B ADVAPI32.77DA6E02 ADVAPI32.77DA7086
0012EC60 0043F15D Includes ADVAPI32.77DA708B Avira_Se.0043F15B
0012EC9C 0043F3F8 Avira_Se.0043F0D2 Avira_Se.0043F3F3
0012F5B4 00CC00CC *** CORRUPT ENTRY ***
7. SOLUTION
-----------
Update to v1.0.0.2 Build 3630 or later
8. REPORT TIMELINE
------------------
2013-10-30: Discovery of the vulnerability
2013-11-03: RCE Security sends first notification to vendor via mail
with disclosure date set to 18. November 2013
2013-11-03: MITRE assigns CVE-2013-6356 for this issue
2013-11-04: Vendor ACKs the vulnerability
2013-11-10: RCE Security asks for a status
2013-11-11: Vendor expects to receive a fix the same day
2013-11-13: Vendor releases v1.0.0.2 Build 3630 which fixes CVE-2013-6356
2013-11-16: Coordinated Disclosure
