Share
Hi @ll,  
  
Intel® Processor Identification Utility - Windows* Version,  
version 6.0.0211 from 2019-02-11, available from  
<https://downloadmirror.intel.com/28539/a08/Intel(R)%20Processor%20Identification%20Utility.exe>  
via <https://downloadcenter.intel.com/download/28539>, and  
earlier versions 6.0.* are vulnerable: in default installations  
of all supported versions of Windows (really: Windows Vista and  
later), they allows arbitrary code execution WITH escalation of  
privilege via two INDEPENDENT attack vectors; additionally they  
suffer from a denial of service.  
  
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H  
CVSS 3 Score: 8.2 (High)  
  
  
Vulnerability #1:  
=================  
  
Arbitrary code execution with escalation of privilege  
  
Reason:  
~~~~~~~  
  
Use of ShellExecute() to run a batch script, i.e. use of file  
association .bat: ShellExecute() reads the registry key  
HKEY_CLASSES_ROOT to determine  
1. the file type associated with any given file extension  
(here: .bat), and  
2. the command line associated with the file type (here:  
batfile).  
HKEY_CLASSES_ROOT is a virtual registry key, built from the  
overlay of HKEY_LOCAL_MACHINE\SOFTWARE\Classes with  
HKEY_CURRENT_USER\Software\Classes, i.e. the latter taking  
precedence over the former.  
HKEY_CURRENT_USER is under full control of the unprivileged  
user who can hijack both the association of batfile to .bat  
and the command lines associated with the verbs registered  
for batfile.  
  
Fix:  
~~~~  
  
Don't use ShellExecute() when running elevated, use  
CreateProcess("C:\\Windows\\System32\\cmd.exe", "cmd.exe /C Call path\\filename.bat", ...)  
instead!  
  
Demonstration/Proof of concept:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
1. Log on with the user account created during Windows setup;  
  
2. Download  
<https://skanthak.homepage.t-online.de/download/SENTINEL.EXE>  
and save it in an arbitrary directory;  
  
3. Open a command prompt in the directory where you saved  
SENTINEL.EXE and run the following command line:  
REG.EXE ADD "HKEY_CURRENT_USER\Software\Classes\batfile\Shell\Open\Command" /VE /T REG_SZ /D "%CD%\SENTINEL.EXE" /F  
  
4. Download  
<https://downloadmirror.intel.com/28539/a08/Intel(R)%20Processor%20Identification%20Utility.exe>  
and save it in an arbitrary directory;  
  
5. Execute the just downloaded installation program  
"Intel(R) Processor Identification Utility.exe"  
and answer the prompts: upon completion, notice the  
message box titled "Vulnerability and Exploit Detector",  
displayed by SENTINEL.EXE running elevated!  
  
  
Vulnerability #2:  
=================  
  
Arbitrary code execution with escalation of privilege  
  
Reason:  
~~~~~~~  
  
UNSAFE %TEMP% directory used for 77+ files extracted from  
both the executable installation program  
"Intel(R) Processor Identification Utility.exe" and the  
extracted MSI installer %TEMP%\AIE*.tmp, plus unqualified  
filename ATTRIB used in the script %TEMP%\EXE*.tmp.bat  
  
See <https://cwe.mitre.org/data/definitions/377.html>,  
<https://cwe.mitre.org/data/definitions/378.html> and  
<https://cwe.mitre.org/data/definitions/379.html>, plus  
<https://cwe.mitre.org/data/definitions/426.html> and  
<https://cwe.mitre.org/data/definitions/427.html>  
  
1. In the user account created during Windows setup, any  
process running unprivileged has FULL access to %TEMP%.  
  
2. The command processor searches executables in the CWD  
(which happens to be %TEMP% here) first.  
  
Fix:  
~~~~  
  
1. Create all extracted and temporary files with proper  
permissions, i.e. writable/accessible only for  
administrators, or in a directory where only  
administrators can write/modify!.  
  
2. Use fully qualified pathnames: ATTRIB is always  
"%SystemRoot%\System32\attrib.exe"  
  
Mitigations:  
~~~~~~~~~~~~  
  
1. Set the environment variable  
NoDefaultCurrentDirectoryInExePath  
to an arbitrary value: this excludes . from the search  
path of the command processor (see  
<https://msdn.microsoft.com/en-us/library/ms684269.aspx>).  
  
2. Add the NTFS access control entry (D;OIIO;WP;;;WD) meaning  
"deny execution of files for everyone, inheritable to files  
in all subdirectories" to all TEMP directories.  
  
JFTR: every batch script or program which fails after applying  
of one of these changes is VULNERABLE and needs to be  
fixed ANYWAY!  
  
Demonstration/Proof of concept:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
1. Log on with the user account created during Windows setup;  
  
2. Download  
<https://skanthak.homepage.t-online.de/download/SENTINEL.EXE>  
and save it as ATTRIB.COM or ATTRIB.EXE in your %TEMP%  
directory;  
  
3. Download  
<https://downloadmirror.intel.com/28539/a08/Intel(R)%20Processor%20Identification%20Utility.exe>  
and save it in an arbitrary directory;  
  
4. Execute the just downloaded installation program  
"Intel(R) Processor Identification Utility.exe"  
and answer the prompts: upon completion, notice the  
message boxes titled "Vulnerability and Exploit Detector",  
displayed by %TEMP%\ATTRIB.COM or %TEMP%\ATTRIB.EXE  
running elevated!  
  
Alternate attack:  
~~~~~~~~~~~~~~~~~  
  
Any of the 77+ files extracted into %TEMP% can be modified by  
the unprivileged user between creation and use, for example  
with a simple batch script as shown below, which is started  
any time before the executable installer:  
  
--- intel.cmd ---  
@echo off  
:WAIT  
if not exist "%TEMP%\AI_EXTUI_BIN_*" goto :WAIT  
for /D %%? in ("%TEMP%\AI_EXTUI_BIN_*") do set FOOBAR=%%?  
rem now replace for example "%FOOBAR%\viewer.exe" with  
rem an arbitrary executable  
--- EOF ---  
  
As soon as one of these files is executed during installation,  
the attacker gains administrative privileges.  
  
  
Vulnerability #3:  
=================  
  
Denial of service  
  
Reason: see vulnerability #1  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Fix: see vulnerability #1  
~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Demonstration/Proof of concept:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
1. Log on with the user account created during Windows setup;  
  
2. Add the NTFS access control entry (D;OIIO;WP;;;WD) meaning  
"deny execution of files for everyone, inheritable to files  
in all subdirectories" to your %TEMP% directory;  
  
3. Download  
<https://downloadmirror.intel.com/28539/a08/Intel(R)%20Processor%20Identification%20Utility.exe>  
and save it in an arbitrary directory;  
  
4. Execute the just downloaded installation program  
"Intel(R) Processor Identification Utility.exe":  
notice the error messages displayed from Windows  
Installer due to non-executable DLLs written in  
the %TEMP% directory!  
  
  
Timeline:  
=========  
  
2019-07-17 first vulnerability report sent to vendor  
  
2019-07-18 Intel's PSIRT opens case #2208018370  
  
2019-07-28 Intel's PSIRT confirms reported vulnerability  
  
2019-08-01 second vulnerability report sent to vendor  
  
  
stay tuned, and FAR away from executable installers!  
Stefan Kanthak  
  
PS: wrapping an MSI installer in an executable self-extractor  
is COMPLETE nonsense!