SEC Consult SA-20140218-0 :: Multiple critical vulnerabilities in

SEC Consult Vulnerability Lab Security Advisory < 20140218-0 >
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
              title: Multiple critical vulnerabilities
            product: Symantec Endpoint Protection
 vulnerable version: 11.0, 12.0, 12.1
      fixed version: >=3D11.0.7405.1424
                     >=3D12.1.4023.4080
             impact: Critical
         CVE number: CVE-2013-5014, CVE-2013-5015
           homepage: http://www.symantec.com
              found: 2013-12-03
                 by: Stefan Viehb=C3=B6ck
                     SEC Consult Vulnerability Lab=20
                     https://www.sec-consult.com
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


Vendor description:
-------------------
"Symantec Endpoint Protection is a client-server solution that protects
laptops, desktops, Windows and Mac computers, and servers in your network
against malware. Symantec Endpoint Protection combines virus protection with
advanced threat protection to proactively secure your computers against kno=
wn
and unknown threats.
Symantec Endpoint Protection protects against malware such as viruses, worm=
s,
Trojan horses, spyware, and adware. It provides protection against even the
most sophisticated attacks that evade traditional security measures, such as
rootkits, zero-day attacks, and spyware that mutates. Providing low mainten=
ance
and high power, Symantec Endpoint Protection communicates over your network=
 to
automatically safeguard for both physical systems and virtual systems again=
st
attacks."

Source:
https://www.symantec.com/endpoint-protection
https://www.symantec.com/business/support/index?page=3Dcontent&id=3DDOC6153


Business recommendation:
------------------------
Attackers are able to completely compromise the Endpoint Protection Manager=
=20
server as they can gain access at the system and database level.
Furthermore attackers can manage all endpoints and possibly deploy
attacker-controlled code on endpoints.

The Endpoint Protection Manager server can be used as an entry point into
the target infrastructure (lateral movement, privilege escalation).

It is highly recommended by SEC Consult not to use this software until a
thorough security review has been performed by security professionals and a=
ll
identified issues have been resolved.

It is assumed that further critical vulnerabilities exist.


Vulnerability overview/description:
-----------------------------------
1) Unauthenticated XML External Entity Injection (XXE) (CVE-2013-5014)
Multiple XXE vulnerabilities were found in the Endpoint Protection Manager=
=20
application. These vulnerabilities can be used to execute server side reque=
st
forgery (SSRF) attacks used for portscanning/fingerprinting, denial of serv=
ice,
possibly file disclosure as well as attacks against functionality that is o=
nly
exposed internally (see 2).

2) Unauthenticated local SQL injection (CVE-2013-5015)
The identified SQL injection vulnerability enables an unauthenticated attac=
ker
to execute arbitrary commands on the underlying operating system with the
privileges of the SQL server service (SYSTEM). This was confirmed in the
default setup using the internal SQL server (SQL Anywhere). This vulnerabil=
ity
can be used to exfiltrate database content (eg. usernames and password hash=
es)
as well (eg. on other DMBS).

As the vulnerable functionality is only available for requests coming from
localhost, the XXE vulnerability (see 1) can be used to exploit it remotely.

Note:
These vulnerabilities can be exploited via Cross-Site Request Forgery (CSRF)
as well. An attacker does not need direct network access to the vulnerable
application!


Proof of concept:
-----------------
1) Unauthenticated XML External Entity Injection (XXE) (CVE-2013-5014)
The following request shows how XXE injection can be used to request arbitr=
ary
resources. The affected functionality is available via TCP port 9090 (HTTP)
and 8443 (HTTPS).
Affected script: /servlet/ConsoleServlet

Detailed proof of concept exploits have been removed for this vulnerability.


2) Unauthenticated local SQL injection (CVE-2013-5015)
The following request exploits the SQL injection vulnerability to execute
arbitrary commands using the xp_cmdshell() system procedure (available in S=
QL
Anywhere), no authentication is needed but it only works when executed from
localhost.

Using the XXE vulnerability, SQL injection can be exploited via the local
network/Internet. The affected functionality is available via TCP port 9090
(HTTP) and 8443 (HTTPS).
Affected script: /servlet/ConsoleServlet


This vulnerability can be used to exfiltrate database content (eg. usernames
and password hashes) as well. All usernames and password hashes are stored
within the database as MD5 hash without salt.


Detailed proof of concept exploits have been removed for this vulnerability.


Vulnerable / tested versions:
-----------------------------
The vulnerabilities have been verified to exist in Symantec Endpoint Protec=
tion
version 12.1.4013, which was the most recent version at the time of discove=
ry.
According to Symantec versions 11.0, 12.0 and 12.1 are affected.


Vendor contact timeline:
------------------------
2013-12-16: Sending advisory and proof of concept exploit via encrypted
            channel.
2013-12-16: Vendor acknowledges receipt of advisory.
2014-01-09: Requesting status update and setting release date (2014-01-31).
2014-01-09: Vendor responds and wants to release update in "March timeframe"
2014-01-14: Clarifying reasons for accelerated disclosure (criticality,
            increased expectations from European customers, ...) in complia=
nce
            with the SEC Consult Responsible Disclosure Policy.
2014-01-23: Contacting CERT teams (CERT-Bund Germany, CERT-CC and CERT.at).
2014-01-27: Conference call: extending advisory release date (2014-02-18).
2014-02-13: Symantec releases fixed versions.=20
2014-02-18: SEC Consult releases coordinated security advisory.


Solution:
---------
Update to the most recent version (11.0.7405.1424 and 12.1.4023.4080) of
Symantec Endpoint Protection.

More information can be found at:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=3D=
security_advisory&pvid=3Dsecurity_advisory&year=3D&suid=3D20140213_00

http://www.symantec.com/business/support/index?page=3Dcontent&id=3DTECH2148=
66


Workaround:
-----------
No workaround available.


Advisory URL:
--------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab

SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius

Headquarter:
Mooslackengasse 17, 1190 Vienna, Austria
Phone:   [phone]
Fax:     [phone]

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

Interested in working with the experts of SEC Consult?
Write to [e-mail]

EOF Stefan Viehb=C3=B6ck / @2014