Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

1/23/2018
01:01 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Kaspersky Lab Discovers Multiple Vulnerabilities in Widely Spread Corporate License Management Software

Woburn, MA – January 22, 2018 – According to Kaspersky Lab ICS CERT researchers, a variety of serious vulnerabilities have been identified in the Hardware Against Software Piracy (HASP) license management system of popular license management software used in corporate and ICS environments to activate software on PCs and servers. If these vulnerabilities are left unpatched, the popular license management USB-token can be used to open a hidden remote access channel for cyberattackers.

Kaspersky Lab ICS CERT researchers have identified 14 vulnerabilities in a component of the software solution, including multiple denial-of-service (DoS) vulnerabilities and several RCEs (remote execution of arbitrary code) which, for instance, are automatically exploited not with user rights, but with the most privileged system rights. This provides attackers with an opportunity to execute any arbitrary codes. All identified vulnerabilities can be potentially very dangerous and result in major losses for businesses.

The USB-tokens in question are widely used in different organizations to serve the purpose of convenient software license activation. In normal use case scenarios, a company’s system administrator would need to approach the computer with the software that needs to be activated and insert the token. It will then confirm that the software of interest is legitimate (not pirated) and would activate it.

Once the token is attached to a PC or a server for the first time, Windows OS downloads the software driver from the vendor’s servers in order to make the token hardware work properly with the computer hardware. In other cases, the driver comes installed with third party software which uses the aforementioned system for license protection. Our experts have found that, upon installation, this software adds port 1947 of the computer to the list of exclusions of the Windows Firewall with no proper user notification, which makes it vulnerable to a remote attack. An attacker would only need to scan the targeted network for open port 1947 in order to identify any remotely available computers.

More importantly, the port remains open after the token has been detached, which is why even in a patched and protected corporate environment, an attacker would only need to install software using the HASP solution, or attach the token to a PC once (even a locked one) in order to make it available for remote attacks.

Although the number of systems affected by the vulnerability is uncertain, due to the popularity of the software, it may amount to hundreds of thousands of users worldwide. All of the research has been reported to the vendor. All discovered vulnerabilities received the following CVE numbers:

“Given how popular this license management system is, the possible scale of the consequences of these vulnerabilities going unpatched is very large,” said Vladimir Dashchenko, head of vulnerability research group, Kaspersky Lab ICS CERT. “Since these tokens are not only used in regular corporate environments, but also in critical facilities with strict remote access rules, the vulnerabilities we discovered could be putting thousands of critical networks in danger.”

Upon discovery, Kaspersky Lab reported these vulnerabilities to the affected software vendors and the companies subsequently released security patches.

Kaspersky Lab ICS CERT strongly recommends that corporate and ICS organizations using the affected products do the following:

 

  • Install the latest (secure) version of the driver as soon as possible, or contact the vendor for instructions on updating the driver.
  • As long as it does not interfere with business processes, close port 1947, at least on the external firewall (on the network perimeter).

 

You can read more about these vulnerabilities in the blog post on the Kaspersky Lab ICS CERT website here.

About Kaspersky Lab

Kaspersky Lab is a global cybersecurity company celebrating its 20 year anniversary in 2017. Kaspersky Lab’s deep threat intelligence and security expertise is constantly transforming into next generation security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky Lab technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.

 

For the latest in-depth information on security threat issues and trends, please visit:

Securelist | Information about Viruses, Hackers and Spam
Follow @Securelist on Twitter

Threatpost | The First Stop for Security News
Follow @Threatpost on Twitter

 

About Kaspersky Lab ICS CERT

Kaspersky Lab Industrial Control Systems Cyber Emergency Response Team (Kaspersky Lab ICS CERT) is a global project launched by Kaspersky Lab in 2016 to coordinate the efforts of automation system vendors, industrial facility owners and operators, and IT security researchers to protect industrial enterprises from cyberattacks. Kaspersky Lab ICS CERT devotes its efforts primarily to identifying potential and existing threats that target industrial automation systems and the Industrial Internet of Things. During its first year of operation, the team identified over 110 critical vulnerabilities in products by major global ICS vendors. Kaspersky Lab ICS CERT is an active member and partner of leading international organizations that develop recommendations on protecting industrial enterprises from cyberthreats.

 

###

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Tor Weaponized to Steal Bitcoin
Dark Reading Staff 10/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18218
PUBLISHED: 2019-10-21
cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
CVE-2019-18217
PUBLISHED: 2019-10-21
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.
CVE-2019-16862
PUBLISHED: 2019-10-21
Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter.
CVE-2019-17409
PUBLISHED: 2019-10-21
Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter.
CVE-2019-10715
PUBLISHED: 2019-10-21
There is Stored XSS in Verodin Director before 3.5.4.0 via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages.