CVE-2021-33975
📋 TL;DR
A buffer overflow vulnerability in Qihoo 360 Total Security allows attackers to execute arbitrary code with elevated privileges. This affects users running vulnerable versions of the security software, potentially compromising the entire system. The vulnerability stems from improper bounds checking (CWE-120) in the software's components.
💻 Affected Systems
- Qihoo 360 Total Security
📦 What is this software?
Safe Browser by Browser.360
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM/root privileges, enabling installation of persistent malware, data theft, and lateral movement across networks.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, disable antivirus protection, and gain administrative access to the system.
If Mitigated
Limited impact if proper endpoint protection, application whitelisting, and least privilege principles are enforced.
🎯 Exploit Status
Exploitation requires local access to the system. Proof-of-concept code has been publicly shared in pastebin links and blog posts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after v10.8.0.1213
Vendor Advisory: Not publicly available
Restart Required: Yes
Instructions:
1. Open Qihoo 360 Total Security
2. Navigate to Settings > Update
3. Click 'Check for Updates'
4. Install any available updates
5. Restart the computer
🔧 Temporary Workarounds
Uninstall vulnerable version
windowsRemove Qihoo 360 Total Security and replace with alternative security software
Control Panel > Programs > Uninstall a program > Select 'Qihoo 360 Total Security' > Uninstall
Restrict execution privileges
windowsApply least privilege principles to limit damage from successful exploitation
🧯 If You Can't Patch
- Disable or uninstall Qihoo 360 Total Security immediately
- Implement application control/whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Qihoo 360 Total Security version in the application's About section or Windows Programs listCheck Version:
wmic product where name="Qihoo 360 Total Security" get versionVerify Fix Applied:
Verify version is newer than v10.8.0.1213 and no longer shows the vulnerable version numbers📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Qihoo 360 processes
- Failed privilege escalation attempts in Windows Event Logs
- Antivirus service crashes or unexpected terminations
Network Indicators:
- Unusual outbound connections from Qihoo 360 processes
- Beaconing behavior from compromised systems
SIEM Query:
Process Creation where (Image contains "360" OR ParentImage contains "360") AND (CommandLine contains unusual patterns)🔗 References
- https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html
- https://pastebin.com/ivNL7s0n
- https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
- https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html
- https://pastebin.com/ivNL7s0n
- https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
