1. Symantec/
  2. Security Response/
  3. Security Updates Detail

Security Advisories Relating to Symantec Products - Symantec Endpoint Protection Multiple Issues

SYM15-007

July 30, 2015

Revisions

08/03/2015 – Added note that proof-of-concept code has been released publicly.

Mitigation for Client Binary Planting was removed due to inadvertent side effects. Customers that previously implemented that mitigation should recreate an empty SmcLU directory in the original location (for example, C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.6168.6000.105\SmcLu).


Severity


CVSS2

Base Score

Impact

Exploitability

CVSS2 Vector

SEPM Authentication Bypass - High

7.5

6.4

10

AV:N/AC:L/Au:N/C:P/I:P/A:P

SEPM Arbitrary File Write - Medium

5.5

4.9

8.0

AV:N/AC:L/Au:S/C:N/I:P/A:P

SEPM Arbitrary File Read -Medium

4.0

2.9

8.0

AV:N/AC:L/Au:S/C:P/I:N/A:N

SEPM Privilege Escalation - High

8.5

10

6.8

AV:N/AC:M/Au:S/C:C/I:C/A:C

SEPM SQL Injection - Medium

6.0

6.4

6.8

AV:N/AC:M/Au:S/C:P/I:P/A:P

SEPM Path Traversal - Medium

5.5

4.9

8.0

AV:N/AC:L/Au:S/C:N/I:P/A:P

SEP Client Binary Planting - High

8.5

10

6.8

AV:N/AC:M/Au:S/C:C/I:C/A:C


NOTE: Proof of concept code has been publicly released

Overview


The management console for Symantec Endpoint Protection Manager (SEPM) is susceptible to multiple vulnerabilities including SQL Injection, authentication bypass, possible path traversal and the potential for arbitrary file read/write. SEP clients are susceptible to a binary planting vulnerability that could result in arbitrary code running with system privileges on a client.


Affected Products


Product

Version

Build

Solution(s)

Symantec Endpoint Protection Manager

12.1

All

Update to 12.1-RU6-MP1

Symantec Endpoint Protection Clients

12.1

All

Update to 12.1-RU6-MP1


Details


The management console for Symantec Endpoint Protection Manager (SEPM) is susceptible to manipulation of the password reset functionality to potentially generate a new administrative session being created and assigned to the requestor. The new session can be used to bypass proper authentication to access the server.


An arbitrary file write vulnerability exists due to improper file name validation in a console session that could allow an authorized SEPM user to write arbitrary files in the context of the corresponding user. There is also an arbitrary file read vulnerability due to improper validation in one of the action handlers. This could allow an authenticated user to read arbitrary files they may not have been authorized access to. Further, by leveraging the file write vulnerability, an authorized but less-privileged user could potentially manipulate SEPM services to launch arbitrary code with administrator privileges to further elevate their normal privileges.


SEPM does not properly validate/sanitize SQL input. This could enable an authorized but less-privileged user to potentially run an unauthorized arbitrary SQL query against the backend database. This would include Limited Administrators as implemented in Symantec Endpoint Protection Manager. This could possibly allow access to or manipulation of data resulting in potential unauthorized access to restricted server-side data and possible ability to leverage additional console management functionality.


Also identified was the potential for a path traversal issue during the importing of a client installation package to SEPM. The package is not sufficiently validated/sanitized during the process. A malicious individual could potentially submit a specifically configured package containing a relative path of their creation in an attempt to access files and/or directories external to the authorized install folder.


SEP clients are susceptible to a potential binary attack/dll preloading issue resulting from not properly restrict the loading of external libraries. An authorized but malicious user with access to a system could potentially insert a specifically-crafted library into a client install package. Successful exploitation could allow unauthorized arbitrary code to be executed with system privileges.


In a recommended installation, the Symantec Endpoint Protection Manager server should never be accessible external to the network which still allows internal attack attempts from malicious less-privileged users but should restrict external attack attempts. However, a malicious, non-authorized individual could leverage known methods of trust exploitations to compromise a client user in an attempt to gain network/system access. These exploitation attempts generally require enticing a previously authenticated user to access a malicious link in a context such as a web link or in an HTTP email.


Symantec Response
Symantec product engineers verified these issues. SEPM 12.1-RU6-MP1 contains updates that address these issues. Customers should implement the mitigations described below until the available update can be installed to address these issues. Symantec is not aware of exploitation of or adverse customer impact from this issue.


Update Information

Symantec Endpoint Protection Manager 12.1-RU6-MP1 is available from Symantec File Connect.


Mitigations


For SEPM Authentication Bypass - High:


Customers that cannot immediately upgrade their SEPM to RU6 MP1 can mitigate the issue by manually disabling the option for SEPM administrators to reset their passwords.


To disable password resets:

  1. In the Symantec Endpoint Protection Manager console, click Admin
  2. In the Admin page, under Tasks, click Servers
  3. In the Admin page, under view, expand Local Site (Site site name) or expand Remote Site
  4. Select the site whose properties you want to edit
  5. In the Admin page, under Tasks, click Edit Site Properties
  6. Select the Passwords tab
  7. Uncheck the selection for "Allow administrators to reset the passwords"
  8. Click OK

Note: This will need to be configured for each site in the environment.


Symantec will be releasing the following IPS signatures to detect/prevent attempts against some of these issues in SEPM. These detections will be available through normal Symantec security update channels.

28651 (Web Attack: SEPM SQL Injection)

28650 (Web Attack: SEPM Directory Traversal)

28649 (Web Attack: SEPM unauthenticated password reset)


Best Practices


As part of normal best practices, Symantec strongly recommends the following:

  • Restrict access to administrative or management systems to authorized privileged users.

  • Restrict remote access, if required, to trusted/authorized systems only.

  • Run under the principle of least privilege where possible to limit the impact of potential exploit.

  • Keep all operating systems and applications current with vendor patches.

  • Follow a multi-layered approach to security. At a minimum, run both firewall and anti-malware applications to provide multiple points of detection and protection to both inbound and outbound threats.

  • Deploy network- and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in the detection of attacks or malicious activity related to the exploitation of latent vulnerabilities.


    Credit


    Symantec would like to thank Markus Wulftange of Code White (http://www.code-white.com), for reporting these issues and working very closely with Symantec as they were addressed.


    References


    CVE: These issues are candidates for inclusion in the CVE list (http://cve.mitre.org/cve), which standardizes identifiers for security problems.


    BID: Symantec SecurityFocus, http://www.securityfocus.com, has assigned Bugtraq IDs (BIDs) to these issues for inclusion in the Security Focus vulnerability database.


CVE

BID

Description

CVE-2015-1486

BID 76074

SEPM Authentication Bypass

CVE-2015-1487

BID 76094

SEPM Arbitrary File Write

CVE-2015-1488

BID 76077

SEPM Arbitrary File Read

CVE-2015-1489

BID 76078

SEPM Privilege Escalation

CVE-2015-1490

BID 76081

SEPM Path Traversal

CVE-2015-1491

BID 76079

SEPM SQL Injection

CVE-2015-1492

BID 76083

SEP Client Binary Planting



REPORTING VULNERABILITIES TO SYMANTEC

Symantec takes the security and proper functionality of our products very seriously. As founding members of the Organization for Internet Safety (OISafety), Symantec supports and follows responsible disclosure guidelines.
Symantec has developed a Software Security Vulnerability Management Process document outlining the process we follow in addressing suspected vulnerabilities in our products.
Symantec Corporation firmly believes in a proactive approach to secure software development and implements security review into various stages of the software development process. Additionally, Symantec is committed to the security of its products and services as well as to its customers’ data. Symantec is committed to continually improving its software security process.
This document provides an overview of the current Secure Development Lifecycle (SDLC) practice applicable to Symantec’s product and service teams as well as other software security related activities and policies used by such teams. This document is intended as a summary and does not represent a comprehensive list of security testing and practices conducted by Symantec in the software development process.
Please contact secure@symantec.com if you believe you have discovered a security issue in a Symantec product. A member of the Symantec Software Security team will contact you regarding your submission to coordinate any required response. Symantec strongly recommends using encrypted email for reporting vulnerability information to secure@symantec.com.
The Symantec Software Security PGP key can be found at the following location:
COPYRIGHT (C) BY SYMANTEC CORP.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Software Security. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com.
Last modified on: July 30, 2015
Security Response Blog
The State of Spam