DESLock+ Client up to 4.8.16 Kernel Driver DLMFENC.sys IOCTL Message memory corruption

Summaryinfo

A vulnerability classified as critical has been found in DESLock+ Client up to 4.8.16. This affects an unknown part of the file DLMFENC.sys of the component Kernel Driver. This manipulation as part of IOCTL Message causes memory corruption. This vulnerability is handled as CVE-2017-12840. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability was found in DESLock+ Client up to 4.8.16. It has been declared as critical. Affected by this vulnerability is some unknown processing of the file DLMFENC.sys of the component Kernel Driver. The manipulation as part of a IOCTL Message leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap based buffer overflow in the handling of an IOCTL message of type 0x0FA4204. The vulnerability is present due to the kernel driver failing to allocate sufficient memory on the kernel heap to contain a user supplied string as such the string is copied into a buffer of constant size (0x1000-bytes) and thus an overflow condition results. Access to the kernel driver is permitted through an obfuscated interface whereby bytes of user supplied message are "authenticated" via an obfuscation routine employing a linear equation.

The bug was discovered 08/15/2017. The weakness was released 08/28/2017 (Website). It is possible to read the advisory at trustwave.com. This vulnerability is known as CVE-2017-12840 since 08/14/2017. Attacking locally is a requirement. Required for exploitation is a single authentication. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 13 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• DESLock+

Name

• Client

Version

• 4.8.0
• 4.8.1
• 4.8.2
• 4.8.3
• 4.8.4
• 4.8.5
• 4.8.6
• 4.8.7
• 4.8.8
• 4.8.9
• 4.8.10
• 4.8.11
• 4.8.12
• 4.8.13
• 4.8.14
• 4.8.15
• 4.8.16

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion