[NT] Akamai Download Manager Arbitrary Program Execution Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Akamai Download Manager Arbitrary Program Execution Vulnerability
------------------------------------------------------------------------


SUMMARY

<http://www.akamai.com/html/technology/products/http_downloads.html>
Akamai Download Manager is "an integral component of Akamai's global
distribution service. It is used to deliver big files quickly and reliably
to users around world. It has been used by vendors such as Symantec and
Microsoft to provide downloads to the public".

Akamai "provides both an ActiveX and a Java based Download Manager. If a
user uses the ActiveX control once, it will remain installed on the users
computer until manually removed".

Remote exploitation of a design error in Akamai Technologies, Inc's
Download Manager allows attackers to execute arbitrary code in the context
of the current user.

DETAILS

Vulnerable Systems:
* Akamai Technologies Inc's DownloadManagerV2.ocx version 2.2.2.1
* Akamai Technologies Inc's Download Manager Java Applet version 2.2.2.0

Immune Systems:
* Akamai Technologies Inc's DownloadManagerV2.ocx version 2.2.3.5
* Akamai Technologies Inc's Download Manager Java Applet version 2.2.3.5

The ActiveX control version has the following identifiers:
Class: DownloadManager Control
CLSID: 2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B
CLSID: FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1
ProgId: MANAGER.DLMCtrl.1.
File: C:\Windows\Downloaded Program Files\DownloadManagerV2.ocx

The Java version has the following identifiers:
Class: com.akamai.dm.ui.applet.DMApplet.class
JAR: dlm-java-2.2.2.0.jar

This problem specifically exists due to two undocumented object
parameters. By using these parameters, it is possible to cause Download
Manager to automatically download and execute arbitrary binaries from
attacker controlled locations.

Analysis:
Exploitation allows an attacker to execute arbitrary code in the context
of the user viewing a maliciously crafted web page.

In order to exploit this vulnerability, an attacker would need to
persuade, or otherwise force, a user to view a malicious web page. This is
usually accomplished by getting the targeted user to click a link in a
form of electronic communication such as e-mail or instant messaging.

While the attack is happening, the Download Manager user interface is
displayed. However, in a normal attack scenario there is insufficient time
to cancel the download before exploitation occurs.

Workaround:
Setting kill-bits for the associated CLSIDs will prevent the ActiveX
control from being loaded within Internet Explorer, thereby preventing
exploitation.

Disabling Java will prevent exploitation using the Java Applet version.

Vendor response:
Akamai has addressed this vulnerability with the release of version
2.2.3.5 of their Download Manager product. For more information, refer to
their advisory. To download the updated version, visit the following URL.
<http://dlm.tools.akamai.com/tools/upgrade.html>
http://dlm.tools.akamai.com/tools/upgrade.html

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6339>
CVE-2008-6339

Disclosure Timeline:
12/06/2007 - Initial vendor notification
12/06/2007 - Initial vendor response
04/30/2008 - Public disclosure


ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@xxxxxxxxxxxx> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=695>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=695



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.