Home / vulnerabilities

PDF

WHQL-signed Synaptics Touchpad Driver Rogue Program Execution

Posted on 09 May 2014
Source : packetstormsecurity.org Link

 

Hi @ll,

the WHQL-signed(!) Synaptics touchpad driver delivered via Windows Update
executes a rogue program C:Program.exe with system privileges after its
installation.

The observed offending command line is
C:Program FilesSynapticsSynTPSynTPEnh.exe /NT /I

According to Microsofts security response team the vulnerable driver was
pulled from Windows Update.

Unfortunately (or should I write: of course) the drivers offered on
Synaptics web site have this silly bug too!

regards
Stefan Kanthak

PS: the following lines of the SYNPD.INF show the same silly bug:

| HKLM,SoftwareMicrosoftWindowsCurrentVersionRun,SynTPEnh,0,"%16422%\%targetdir%SynTPEnh.exe"
| HKLM,SoftwareMicrosoftWindowsCurrentVersionRun,SynTPEnh,0x00020000,"%ProgramFiles%\%targetdir%SynTPEnh.exe"
| HKR,SoftwareSynapticsSynTPPlugInsSynTP,Start,0x00020000,"%ProgramFiles%\%targetdir%SynTPEnh /RegPlugIn"
| HKR,SoftwareSynapticsSynTPEnhPopupConfig,Pressure Graph,0x00020000,"%ProgramFiles%\%targetdir%SynZMetr.exe"
| HKR,SoftwareSynapticsSynTPEnhPopupConfig,MoodPad,0x00020000,"%ProgramFiles%\%targetdir%SynMood.exe"
|
HKR,SoftwareSynapticsSynTPEnhPlugInConfigDefaults2FingerGestures,ConfigID2RunApp,0x00020000,"%ProgramFiles%\%targetdir%SynMood
.exe"
| HKR,SoftwareSynapticsSynTPCpl,PracticeExe,0x00020000,"%ProgramFiles%\%targetdir%Tutorial.exe"
| HKR,SOFTWARESynapticsSynTPCplControls1Multifinger Gestures1Two-Finger
ScrollingDialog7Practice,ActionPath,0x00020000,"%ProgramFiles%\%targetdir%Tutorial.exe"
|
HKR,SOFTWARESynapticsSynTPCplControls2ScrollingDialog94Practice,ActionPath,0x00020000,"%ProgramFiles%\%targetdir%Tutorial.exe
"

It's a shame that developers still dont know how to handle
filenames containing spaces properly: you had 20 years time
to learn that! And of course their QA hat the same time!

Take a look at <http://support.microsoft.com/kb/2647300/de> and
notice the screenshot of REGEDIT.EXE showing the contents of the
registry key
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

OUCH!

Timeline
~~~~~~~~

2014-04-09 sent vulnerability report to Microsoft

2014-04-10 Microsoft asks for more log files

2014-04-10 sent log files to Microsoft

2014-04-11 MSRC 18931 case opened

2014-04-15 sent notice regarding MSKB 2647300

2014-05-08 Microsoft acknowledges vulnerability and pulls driver

 

TOP