1269142 - Privilege escalation via shfolder.dll due to unsafe temp directory created by 7-zip extractors

Status: NEW

(Firefox :: Installer, defect, P5)

Description

[Stefan Kanthak]

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:38.0) Gecko/20100101 Firefox/38.0
Build ID: 20160420141331

Steps to reproduce:

0. download "Firefox Setup 38.8.0esr.exe" or "Firefox Setup 46.0.exe";
1. save attached shfolder.cmd, shfolder.dll and shfolder.exe in arbitrary directory;
2. run shfolder.cmd;
3. execute "Firefox Setup 38.8.0esr.exe" or "Firefox Setup 46.0.exe" and answer UAC prompt.



Actual results:

Rogue executables "shfolder.dll" and "shfolder.exe" are executed with administrative privileges.


Expected results:

No UNSAFE subdirectory "7z*.tmp" must be used/created.
See https://cwe.mitre.org/data/definitions/379.html for this well-known and well-documented beginner's error!

Also see bug 961676 alias CVE-2014-1520

Comment 1

[Stefan Kanthak]

Attachment: Batch script to copy shfolder.dll/exe to unsafe temporary subdirectory

Comment 2

[Stefan Kanthak]

Attachment: shfolder.dll copied by batch script

Comment 3

[Stefan Kanthak]

Attachment: shfolder.exe used by batch script

Comment 4

[Stefan Kanthak]

Attachment: Batch script to copy shfolder.dll/exe to unsafe temporary subdirectoryshfolder.cmd

Comment 6

[Stefan Kanthak]

Are you going to fix this beginner's error in your installers before the 45 day period expires?
See http://home.arcor.de/skanthak/policy.html

Comment 9

[Daniel Veditz [:dveditz]]

Note in the example shell script the same bug can be taken advantage of with maintenanceservice.exe and maintenanceservice_installer.exe, but the actual bug is the temp directory.

Comment 10

[Daniel Veditz [:dveditz]]

Does not meet the bar for our bounty program which is being focused on bugs that can remotely attack Firefox users. This attack assumes the user's machine is already compromised.

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

The severity field for this bug is relatively low, S3. However, the bug has 4 duplicates.
:Amir, could you consider increasing the bug severity?

For more information, please visit auto_nag documentation.

Comment 13

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

The last needinfo from me was triggered in error by recent activity on the bug. I'm clearing the needinfo since this is a very old bug and I don't know if it's still relevant.