Pierluigi Paganini January 26, 2019

Check Point released a security update to address a flaw in its ZoneAlarm security software that could allow privilege escalation.

Check Point released a security update to fix a vulnerability in its antivirus and firewall ZoneAlarm, the flaw could be exploited by attackers to escalate privileges on a system running it.

The flaw was discovered last year by security firm Illumant, it was caused by the use of Microsoft’s Windows Communication Foundation (WCF) framework in the implementation of the software. The flaw was named
OwnDigo because the original name for the WCF was “Indigo”.

“This vulnerability allows a low-privileged user to escalate privileges to SYSTEM-level with the anti-virus software enabled. The vulnerability is due to insecure implementation of inter-process communications within the ZoneAlarm application itself, which allows a low-privilege user to inject and execute code by hijacking the insecure communications with a vulnerable .NET service.” reads a blog post published by Illumant.

“The affected .NET service is running with SYSTEM-level privileges; therefore, injected code is run at the SYSTEM-level, bypassing privilege restrictions and allowing the user to gain full control of the system.”

Experts at Illumant’s started their analysis with previous research made by Fabius Artrel on privilege escalation and code execution flaws in applications that use .NET-based WCF services. Researchers also used the research conducted by Matt Graeber on code-signing attacks.

The flaw could allow an attacker with limited access to the targeted device to execute arbitrary commands with SYSTEM privileges. The vulnerability could be exploited to add a user account with low privileges to the group of administrators.

Experts noticed that any code could be executed on the target system only if they appear to be signed by Check Point, then they forged a fake
Check Point code-signing certificate for a user with limited privileges and installed it on the targeted system. The certificate was then used to sign the exploit and payload code, which could then be executed to elevate privileges.

Illumant published a video PoC for the attack:

https://www.illumant.com/blog/2019/01/17/zonealarm-anti-virus-exploit-video/

Check Point addressed the flaw in October with the release of ZoneAlarm version 15.4.062.17802.

Experts at Illumant believe similar issued could affect any .NET application using WCF.

Pierluigi Paganini

(SecurityAffairs – ZoneAlarm, hacking)

[adrotate banner=”5″] [adrotate banner=”13″]