Telerik Analytics Monitor Library allows DLL hijacking

Overview

Telerik Analytics Monitor Library is a third-party application analytics service that collects detailed application metrics for vendors. Some versions of the Telerik library allow DLL hijacking, allowing an attacker to load malicious code in the context of the Telerik-based application.

Description

CWE-114: Process Control

Telerik Analytics Monitor Library is supplied as a third-party DLL to be integrated into other software. The library is statically linked with its own build of OpenSSL for supporting HTTPS communication.

The vulnerability was introduced in Telerik Analytics Monitor Library version 3.2.96 from August 3, 2014. In version 3.2.96, the OpenSSL library was built with hardware support, allowing the Telerik Analytics Monitor Library to attempt to load a set of well-known cryptography DLLs at runtime. On an affected machine, the Telerik Analytics Monitor Library would try and load four such DLLs (csunsapi.dll, swift.dll, nfhwcrhk.dll, and surewarehook.dll). These four DLLs are not distributed by Telerik. The affected Telerik Analytics Monitor Library DLLs are named EQATEC.Analytics.Monitor.Win32_vc100.dll (for 32-bit systems) and EQATEC.Analytics.Monitor.Win32_vc100-x64.dll (for 64-bit systems), but report file version 1.0.0.1 instead of the correct 3.2.x.

---

Impact

An attacker could exploit this situation by providing malicious DLLs, allowing the attacker to load malicious code in the context of the Telerik-based application. The Telerik Analytics Monitor Library has been used in Industrial Control Systems (ICS), which may allow significant access to the ICS if the vulnerability is exploited.

---

Solution

Apply an update

This behavior was changed in Telerik Analytics Monitor Library version 3.2.125. In version 3.2.125 and later, OpenSSL is built without hardware support and will not attempt to load any third-party DLLs at runtime.

However, Telerik recommends affected users update to version 3.2.129 which not only includes this security fix, but also a fix for a regression introduced after 3.2.125.

---

Vendor Information

The Telerik Analytics Monitor Library is included with several industrial control systems (ICS). We will list known ICS vendors affected below, along with Telerik.

---

794095

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Elipse __ Affected

Updated: March 11, 2015

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the advisory by ICS-CERT:

<https://ics-cert.us-cert.gov/advisories/ICSA-15-069-04A&gt;

Telerik Affected

Updated: March 02, 2015

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://www.telerik.com/support/whats-new/analytics/release-history/analytics-monitor-library-3.2.125&gt;
• <http://www.telerik.com/support/whats-new/analytics/release-history/analytics-monitor-library-v3.2.129&gt;

CVSS Metrics

Group	Score	Vector
Base	6.2	AV:L/AC:H/Au:N/C:C/I:C/A:C
Temporal	4.9	E:POC/RL:OF/RC:C
Environmental	1.2	CDP:ND/TD:L/CR:ND/IR:ND/AR:ND

References

• <http://www.telerik.com/support/whats-new/analytics/release-history/analytics-monitor-library-3.2.125&gt;
• <http://www.telerik.com/support/whats-new/analytics/release-history/analytics-monitor-library-v3.2.129&gt;

Acknowledgements

ICS-CERT credits Ivan Sanchez from Nullcode Team who identified a process control vulnerability that led to discovery of this issue.

This document was written by Garret Wassermann.

Other Information

CVE IDs:	CVE-2015-0978
Date Public:	2015-03-10 Date First Published: