CVE-2021-33971
📋 TL;DR
This CVE describes a set of buffer overflow vulnerabilities in Qihoo 360 security software that allow arbitrary code execution. Remote exploitation is possible via malicious links in affected browsers, while local exploitation targets antivirus kernel flaws for privilege escalation and persistence. Users of Qihoo 360 Safeguard, Total Security, and Safe Browser/Chrome are affected.
💻 Affected Systems
- Qihoo 360 Safeguard
- Qihoo 360 Total Security
- 360 Safe Browser
- 360 Chrome
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, privilege escalation to SYSTEM/admin, and persistent malware installation that evades detection by the very antivirus software it exploits.
Likely Case
Attackers deliver malware via malicious links, gain initial access through browser exploitation, then use local vulnerabilities to maintain persistence and evade security scans.
If Mitigated
With updated software and proper network segmentation, impact is limited to initial browser compromise without privilege escalation or persistence.
🎯 Exploit Status
Proof-of-concept details available in public references. Remote exploitation requires user interaction (opening malicious link). Local exploitation requires initial access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Vendor has released fixes but specific version numbers not provided in CVE description
Vendor Advisory: Not provided in CVE description
Restart Required: Yes
Instructions:
1. Update all affected Qihoo 360 software to latest versions. 2. Restart systems after updates. 3. Verify updates through vendor channels.
🔧 Temporary Workarounds
Disable or remove affected software
windowsUninstall vulnerable Qihoo 360 software and use alternative security solutions
Control Panel > Programs > Uninstall a program > Select Qihoo 360 software > Uninstall
Browser link restrictions
windowsConfigure browser security settings to block automatic execution and restrict untrusted links
🧯 If You Can't Patch
- Network segmentation to isolate systems with vulnerable software
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check installed Qihoo 360 software versions against affected version rangesCheck Version:
Check through software interface: Help > About or Settings > AboutVerify Fix Applied:
Verify all Qihoo 360 software shows version numbers higher than affected ranges📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from browser or Qihoo 360 executables
- Multiple buffer overflow errors in application logs
Network Indicators:
- Unexpected outbound connections from Qihoo 360 processes
- DNS requests to suspicious domains following browser activity
SIEM Query:
Process creation where (parent_process contains '360' OR parent_process contains 'browser') AND (process_name not in approved_list)🔗 References
- https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html
- https://pastebin.com/31v5JMcG
- https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
- https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html
- https://pastebin.com/31v5JMcG
- https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
