Armadito 0.12.7.2 communication.c UTF-16 Chars Malware encoding error

Summaryinfo

A vulnerability identified as critical has been detected in Armadito 0.12.7.2. This issue affects some unknown processing of the file armadito-windows-driver/src/communication.c. This manipulation as part of UTF-16 Chars causes encoding error (Malware). The identification of this vulnerability is CVE-2018-7289. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability classified as critical was found in Armadito 0.12.7.2. Affected by this vulnerability is some unknown functionality of the file armadito-windows-driver/src/communication.c. The manipulation as part of a UTF-16 Chars leads to a encoding error vulnerability (Malware). The CWE definition for the vulnerability is CWE-172. The product does not properly encode or decode the data, resulting in unexpected values. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. This happens because characters that cannot be converted from Unicode are replaced with '?' characters.

The bug was discovered 02/20/2018. The weakness was shared 02/21/2018 (GitHub Repository). The advisory is shared at github.com. This vulnerability is known as CVE-2018-7289 since 02/21/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. Responsible for the vulnerability is the following code:

// Convert unicode string to ansi string for ring 3 process.        
 ntStatus = RtlUnicodeStringToAnsiString(&AnsiString, (PCUNICODE_STRING)FilePath, TRUE); 
 if(!NT_SUCCESS(ntStatus)){ 
	DbgPrint("[-] Error :: ArmaditoGuard!SendScanOrder :: RtlUnicodeStringToAnsiString() routine failed !! \n"); 
	__leave; 
 }

A public exploit has been developed by Souhail Hammou and been published 1 days after the advisory. It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The code used by the exploit is:

?????.exe : 0645 0631 062d 0628 0627 002e 0065 0078 0065

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (44169). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Armadito

Version

• 0.12.7.2

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion