SB2017121459 - Multiple vulnerabilities in Panda Global Protection

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Unquoted Search Path or Element (CVE-ID: CVE-2018-6321)

The vulnerability allows a local authenticated user to execute arbitrary code.

Unquoted Windows search path vulnerability in the panda_url_filtering service in Panda Global Protection 17.0.1 allows local users to gain privileges via a malicious artefact.

2) Input validation error (CVE-ID: CVE-2018-6322)

The vulnerability allows a local authenticated user to execute arbitrary code.

Panda Global Protection 17.0.1 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of .pipePSANMSrvcPpal -- an "insecurely created named pipe." Ensures full access to Everyone users group.

3) Buffer overflow (CVE-ID: CVE-2017-17683)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \.PSMEMDriver DeviceIoControl request.

4) Buffer overflow (CVE-ID: CVE-2017-17684)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \.PSMEMDriver DeviceIoControl request.

Remediation

Install update from vendor's website.

References

• http://seclists.org/fulldisclosure/2018/Mar/25
• http://seclists.org/fulldisclosure/2018/Mar/26
• https://github.com/k0keoyo/Driver-Loaded-PoC/tree/master/Panda-Antivirus/Panda_Security_Antivirus_0xb3702c44
• https://github.com/k0keoyo/Driver-Loaded-PoC/tree/master/Panda-Antivirus/Panda_Security_Antivirus_0xb3702c04_