Symantec pcAnywhere权限许可和访问控制漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1121095 漏洞类型 权限许可和访问控制
发布时间 2012-05-02 更新时间 2012-05-02
CVE编号 CVE-2011-3479 CNNVD-ID CNNVD-201201-363
漏洞平台 Windows CVSS评分 6.8
|漏洞来源
https://www.exploit-db.com/exploits/18823
https://www.securityfocus.com/bid/51593
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201201-363
|漏洞详情
SymantecpcAnywhere是一款功能强大的远程控制软件。SymantecpcAnywhere12.5.x版本至12.5.3版本,ITManagementSuitepcAnywhereSolution7.0版本(也称12.5.x)和7.1版本(也称12.6.x)中存在漏洞。该漏洞源于使用了product-installation文件的world-writable权限。本地用户可利用该漏洞通过修改文件获取权限。
|漏洞EXP
======= 
Summary 
======= 
Name: Symantec pcAnywhere insecure file permissions local privilege escalation 
Release Date: 30 April 2012 
Reference: NGS00117 
Discoverer: Edward Torkington <edward.torkington@ngssecure.com> 
Vendor: Symantec 
Vendor Reference: 
Systems Affected: 

Symantec pcAnywhere 12.5.x 
IT Management Suite 7.0 pcAnywhere Solution 12.5.x 
IT Management Suite 7.1 pcAnywhere Solution 12.6.x 

Risk: High 
Status: Fixed 

======== 
TimeLine 
======== 
Discovered: 23 August 2011 
Released: 14 September 2011 
Approved: 14 September 2011 
Reported: 23 August 2011 
Fixed: 24 January 2012 
Published: 30 April 2012 

=========== 
Description 
=========== 

Inadequate file permissions on application binaries could result on local privilege escalation 

================= 
Technical Details 
================= 
A number of key files in the C:\Program Files\Symantec\pcAnywhere\ folder are writable by any user: 

C:\Program Files\Symantec\pcAnywhere\WinAw32.exe Everyone:(OI)(CI)F 
                                                NT 
AUTHORITY\SYSTEM:(OI)(CI)F 

C:\Program Files\Symantec\pcAnywhere\awrem32.exe Everyone:(OI)(CI)F 
                                                NT 
AUTHORITY\SYSTEM:(OI)(CI)F 

C:\Program Files\Symantec\pcAnywhere\awhost32.exe Everyone:(OI)(CI)F 
                                                 NT 
AUTHORITY\SYSTEM:(OI)(CI)F 

It is trivial to replace these .exe (including the main pcanywhere exe, winaw32.exe with a malicious binary). When launched by the admin, privilege escalation would be gained. The awhost32.exe is set as a service under some scenarios (SYSTEM) and allows a user to privilege escalate by overwriting this binary. 

=============== 
Fix Information 
=============== 

An updated version of the software has been released to address these vulnerabilities: 
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security
_advisory&pvid=security_advisory&year=2012&suid=20120124_00
|受影响的产品
Symantec pcAnywhere Solution 12.6 + Symantec Altiris Client Management Suite 7 + Symantec Altiris Deployment Solution 7.1 +
|参考资料

来源:www.symantec.com
链接:http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120124_00
来源:BID
名称:51593
链接:http://www.securityfocus.com/bid/51593
来源:SECUNIA
名称:47744
链接:http://secunia.com/advisories/47744
来源:NSFOCUS
名称:18680
链接:http://www.nsfocus.net/vulndb/18680