Back to list
Executable installers are vulnerable^WEVIL (case 30): clamwin-0.99-setup.exe allows arbitrary (remote) code execution WITH escalation of privilege
Mar 06 2016 07:06PM
Stefan Kanthak (stefan kanthak nexgo de)
the executable installer clamwin-0.99-setup.exe (available from
<http://www.clamwin.com/download>) loads and executes DWMAPI.dll
or UXTheme.dll from its "application directory".
For software downloaded with a web browser the application
directory is typically the user's "Downloads" directory: see
and <http://seclists.org/fulldisclosure/2012/Aug/134> for
"prior art" about this well-known and well-documented vulnerability.
If an attacker places one of the above named DLL in the user's
"Downloads" directory (for example per "drive-by download"
or "social engineering") this vulnerability becomes a remote
Proof of concept/demonstration:
1. visit <http://home.arcor.de/skanthak/sentinel.html>, download
<http://home.arcor.de/skanthak/download/SENTINEL.DLL>, save it
as UXTheme.dll in your "Downloads" directory, then copy it as
2. download clamwin-0.99-setup.exe and save it in your "Downloads"
3. execute clamwin-0.99-setup.exe from your "Downloads" directory;
4. notice the message boxes displayed from the DLLs placed in
<http://home.arcor.de/skanthak/sentinel.html> for details about
this well-known and well-documented BEGINNER'S error!
PS: I really LOVE (security) software with such trivial beginner's
errors. It's a tell-tale sign to stay away from this snakeoil!
2016-03-06 sent vulnerability report to authors
<security (at) clamwin (dot) com [email concealed]>: host aspmx.l.google.com[220.127.116.11] said: 550-5.1.1
The email account that you tried to reach does not exist. Please try
550-5.1.1 double-checking the recipient's email address for typos or
550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1
https://support.google.com/mail/answer/6596 y186si9894139wmy.43 - gsmtp (in
reply to RCPT TO command)
<clamwin (at) sf (dot) net [email concealed]>: host mx.sourceforge.net[18.104.22.168] said: 550 unknown user
(in reply to RCPT TO command)
2016-03-06 report published
[ reply ]
Copyright 2010, SecurityFocus