SRT2004-01-9-1022 - Symantec LiveUpdate allows local users to become SYSTEM
As usual full details are available at http://www.secnetops.biz/research
-KF
Secure Network Operations, Inc. http://www.secnetops.com/research
Strategic Reconnaissance Team research[at]secnetops[.]com
Team Lead Contact kf[at]secnetops[.]com
Spam Contact `rm -rf /`@snosoft.com
Our Mission:
************************************************************************
Secure Network Operations offers expertise in Networking, Intrusion
Detection Systems (IDS), Software Security Validation, and
Corporate/Private Network Security. Our mission is to facilitate a
secure and reliable Internet and inter-enterprise communications
infrastructure through the products and services we offer.
To learn more about our company, products and services or to request a
demo of ANVIL FCS please visit our site at http://www.secnetops.com, or
call us at: 978-263-3829
Quick Summary:
************************************************************************
Advisory Number : SRT2004-01-09-1022
Product : Symantec LiveUpdate
Version : 1.70.x through 1.90.x
Vendor : http://symantec.com/techsupp/files/lu/lu.html
Class : Local
Criticality : High (to users of the below listed products)
Products Affected : Symantec LiveUpdate 1.70.x through 1.90.x
: Norton SystemWorks 2001-2004
: Norton AntiVirus (and Pro) 2001-2004
: Norton Internet Security (and Pro) 2001-2004
: Symantec AntiVirus for Handhelds v3.0
Operating System(s) : Win32
Notice
************************************************************************
The full technical details of this vulnerability can be found at:
http://www.secnetops.com under the research section.
Basic Explanation
************************************************************************
High Level Description : LiveUpdate allows local users to become SYSTEM
What to do : run LiveUpdate and apply latest patches.
Basic Technical Details
************************************************************************
Proof Of Concept Status : SNO has proof of concept.
Low Level Description : Symantec, the world leader in Internet security
technology, provides a broad range of content and network security
software and appliance solutions to individuals, enterprises and service
providers. The company is a leading provider of client, gateway and server
security solutions for virus protection, firewall and virtual private
network, vulnerability management, intrusion detection, Internet content
and email filtering, and remote management technologies and security
services to enterprises and service providers around the world. Symantec's
Norton brand of consumer security products is a leader in worldwide retail
sales and industry awards. Headquartered in Cupertino, Calif., Symantec
has worldwide operations in 36 countries.
Symantec's Norton Internet Security 2004 provides essential protection
from viruses, hackers, and privacy threats. During an audit of NIS2004
we uncovered a local privilege escalation issue in LiveUpdate. This issue
is similar to the issues that were uncovered in the Windows Help API by
both Brett Moore and our SRT team in late 2003.
Full details available at:
http://www.secnetops.biz/research/SRT2004-01-09-1022.txt and
http://www.secnetops.biz/research/SRT2004-01-09-1022.jpg
Vendor Status : Symantec promptly attended to the issue and
was very responsive during all phases of discovery / research and patching.
Fixes are now available via LiveUpdate.
Bugtraq URL : To be assigned. CVE candidate CAN-2003-0994.
Disclaimer
----------------------------------------------------------------------
This advisory was released by Secure Network Operations,Inc. as a matter
of notification to help administrators protect their networks against
the described vulnerability. Exploit source code is no longer released
in our advisories but can be obtained under contract.. Contact our sales
department at sales[at]secnetops[.]com for further information on how to
obtain proof of concept code.
----------------------------------------------------------------------
Secure Network Operations, Inc. || http://www.secnetops.com
"Embracing the future of technology, protecting you."