--------------------------------------------------------------------------------------------------------
Title: nProtect:Netizen arbitrary file download and execute
vulnerability
nProtectPersonal Web Service arbitrary file download and
execute vulnerability
Discoverer: PARK, GYU TAE (saintlinu@null2root.org)
Neo
Advisory No.: NRVA05-04
NRVA05-05
Critical: High critical
Impact: Gain remote user's privilige
Where: From remote
Operating System: Windows Only
Solution: Patched
Notice: 07. 01. 2005 initiate notify
07. 04. 2005 Second notify
07. 26. 2005 Patched
07. 29. 2005 Disclosure vulnerability
Description:
The nProtect:Netizen and nProtectPersonal Web Service are an antivirus
solutions.
It defends user from Internet about well-known hack tools and viruses something
When it need update and patch itself then download from web site such as
update.nprotect.net
that time nProtect update program, npdownv.exe, DO NOT CHECK THAT update site
URL!!!
We can change URL, update configuration file and so on
But npdownv.exe DO CHECK files that downloaded from update site compressed WITH
PASSWORD!!!
this means npdownv.exe already known password for decompress
I found password in npdownv.exe by REVERSE ENGINEEGERING
and Neo modified liveup.haz, configuration file
When user accees the phishing page then downloaded trojan from hacker URL
See following detail describe:
EXPLOIT NOT INCLUDED HERE
Related link:
http://www.nprotect.co.kr/service/nProtectPersonal/nprotect/npos/kor/personal_npos.html
--------------------------------------------------------------------------------------------------------
Special thanks for My best group Null@root.
PS. I'm very sorry for poor my konglish
__________________________________________________
두 유 야후!?
스팸때문에 짜증나세요? 야후! 메일의 스팸 차단 기술로 메일을 보호합니다
http://mail.yahoo.co.kr_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
