Vulnerability in Symantec Anti Virus Corporate Edition v9.x

[golovast@gmail.com]

The vulnerability has been identified and confirmed in versions 9.0.1.x and 9.0.4.x. I am fairly certain that it exists in all releases of version 9 and possibly other versions as well.

Essentially, the program can be configured to receive updates via Symantec's or an Internal Live update server. If it is configured to receive updates from an internal server, information such as : server name, IP address, subnet, subnet mask, connection
protocol, username and password has to be entered.

This information gets stored in "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Settings.LiveUpdate" file and it does store the username and password in an encrypted format.

The vulnerability shows itself when the server actually gets the updates from the LiveUpdate server. The logging information about the transaction gets written to "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Log.Liveupdate" fi
le.
In that file, regardless of whether the update was successful or not, username and password that are used to connect to the Internal LiveUpdate server are available in clear text.

Examples:

8/24/2005, 17:28:14 PM GMT -> Progress Update: DOWNLOAD_SEGMENT_BATCH_START: Downloading segmented file 1124829658jtun_ennluxdb.x86.full.zip (size 12401134) instead of update file http://domain\username:*******@x.x.x.x/1124829658jtun_ennluxdb.x86 (size 18
047217)

8/31/2005, 0:51:43 AM GMT -> Progress Update: DOWNLOAD_SEGMENT_FILE_START: Downloading segment file http://username:******@x.x.x.x/segments/1125123146jtun_ennluxdb.x86.seg1.zip instead of update 1125123146jtun_ennluxdb.x86: file size 3584000

8/31/2005, 0:51:43 AM GMT -> Progress Update: DOWNLOAD_FILE_START: URL: "http://username:******@x.x.x.x/segments/1125123146jtun_ennluxdb.x86.seg1.zip", Estimated Size: 3584000, Destination Folder: "C:\Documents and Settings\All Users\Application Data\Syma
ntec\LiveUpdate\Downloads"


This can be exploited in a variety of ways. Most obvious is elevation of privileges. Someone can have access with limited permission to login to a server in a low security zone. They will be able to access the log file, since it is located in the "C:\Docu
ments and Settings\All Users\....\.." directory, which is available to all users. A username and password to a service account or a domain account on the Internal LiveUpdate server can be obtained and used to gain access to that server or other servers in
a different security zone.

[Colin]

On 31 Aug 2005 17:35:45 -0000, golovast@gmail.com <golovast@gmail.com> wrot=
e:
> The vulnerability has been identified and confirmed in versions 9.0.1.x a=
nd 9.0.4.x. I am fairly certain that it exists in all releases of version 9=
and possibly other versions as well.


Version 9.0.0.3 doesnt apprear to have this problem.=20

No clear text passwords found in our install.=20

Col.

[James C Slora Jr]

Possible workaround:

Don't allow authenticated access to the LiveUpdate repository. If you allow
read-only anonymous access to the LiveUpdate respository, clients won't need
to store or use credentials. If they don't use credentials the logging issue
goes away.

If you use that method you also don't have to worry about whether the
Settings.LiveUpdate encrypts the saved credentials well enough (because
there won't be any credentials in there).

You would probably have to change both the clients and the server - clients
configured to authenticate may fail to access the anonymous repository.

Anonymous read-only access to LiveUpdate files is often OK because they are
publicly available files. The downside is that anyone can take a look at the
state of your LiveUpdate files and might use version or product information
against you in some way.

YMMV UYOJ