SUMMARY

The management console for Symantec Endpoint Protection Manager (SEPM) is susceptible to multiple vulnerabilities including SQL Injection, authentication bypass, possible path traversal and the potential for arbitrary file read/write. SEP clients are susceptible to a binary planting vulnerability that could result in arbitrary code running with system privileges on a client.

AFFECTED PRODUCTS

ISSUES

MITIGATION

Details

The management console for Symantec Endpoint Protection Manager (SEPM) is susceptible to manipulation of the password reset functionality to potentially generate a new administrative session being created and assigned to the requestor. The new session can be used to bypass proper authentication to access the server.

An arbitrary file write vulnerability exists due to improper file name validation in a console session that could allow an authorized SEPM user to write arbitrary files in the context of the corresponding user. There is also an arbitrary file read vulnerability due to improper validation in one of the action handlers. This could allow an authenticated user to read arbitrary files they may not have been authorized access to. Further, by leveraging the file write vulnerability, an authorized but less-privileged user could potentially manipulate SEPM services to launch arbitrary code with administrator privileges to further elevate their normal privileges.

SEPM does not properly validate/sanitize SQL input. This could enable an authorized but less-privileged user to potentially run an unauthorized arbitrary SQL query against the backend database. This would include Limited Administrators as implemented in Symantec Endpoint Protection Manager. This could possibly allow access to or manipulation of data resulting in potential unauthorized access to restricted server-side data and possible ability to leverage additional console management functionality.

Also identified was the potential for a path traversal issue during the importing of a client installation package to SEPM. The package is not sufficiently validated/sanitized during the process. A malicious individual could potentially submit a specifically configured package containing a relative path of their creation in an attempt to access files and/or directories external to the authorized install folder.

SEP clients are susceptible to a potential binary attack/dll preloading issue resulting from not properly restrict the loading of external libraries. An authorized but malicious user with access to a system could potentially insert a specifically-crafted library into a client install package. Successful exploitation could allow unauthorized arbitrary code to be executed with system privileges.

In a recommended installation, the Symantec Endpoint Protection Manager server should never be accessible external to the network which still allows internal attack attempts from malicious less-privileged users but should restrict external attack attempts. However, a malicious, non-authorized individual could leverage known methods of trust exploitations to compromise a client user in an attempt to gain network/system access. These exploitation attempts generally require enticing a previously authenticated user to access a malicious link in a context such as a web link or in an HTTP email.

Symantec Response 
Symantec product engineers verified these issues. SEPM 12.1-RU6-MP1 contains updates that address these issues. Customers should implement the mitigations described below until the available update can be installed to address these issues. Symantec is not aware of exploitation of or adverse customer impact from this issue.

Update Information

Symantec Endpoint Protection Manager 12.1-RU6-MP1 is available from Symantec File Connect.

Suggested Mitigations

For SEPM Authentication Bypass - High:

Customers that cannot immediately upgrade their SEPM to RU6 MP1 can mitigate the issue by manually disabling the option for SEPM administrators to reset their passwords.

To disable password resets:

1. In the Symantec Endpoint Protection Manager console, click Admin
2. In the Admin page, under Tasks, click Servers
3. In the Admin page, under view, expand Local Site (Site site name) or expand Remote Site
4. Select the site whose properties you want to edit
5. In the Admin page, under Tasks, click Edit Site Properties
6. Select the Passwords tab
7. Uncheck the selection for "Allow administrators to reset the passwords"
8. Click OK

Note: This will need to be configured for each site in the environment.

Symantec will be releasing the following IPS signatures to detect/prevent attempts against some of these issues in SEPM. These detections will be available through normal Symantec security update channels.
 

28651 (Web Attack: SEPM SQL Injection)

28650 (Web Attack: SEPM Directory Traversal)

28649 (Web Attack: SEPM unauthenticated password reset)

Best Practices

As part of normal best practices, Symantec strongly recommends the following:

• Restrict access to administrative or management systems to authorized privileged users.

• Restrict remote access, if required, to trusted/authorized systems only.

• Run under the principle of least privilege where possible to limit the impact of potential exploit.

• Keep all operating systems and applications current with vendor patches.

• Follow a multi-layered approach to security. At a minimum, run both firewall and anti-malware applications to provide multiple points of detection and protection to both inbound and outbound threats.

• Deploy network- and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in the detection of attacks or malicious activity related to the exploitation of latent vulnerabilities.

ACKNOWLEDGEMENTS

Symantec would like to thank Markus Wulftange of Code White (http://www.code-white.com), for reporting these issues and working very closely with Symantec as they were addressed.

REFERENCES

CVE: These issues are candidates for inclusion in the CVE list (http://cve.mitre.org/cve), which standardizes identifiers for security problems.

BID: Symantec SecurityFocus, http://www.securityfocus.com, has assigned Bugtraq IDs (BIDs) to these issues for inclusion in the Security Focus vulnerability database.

REVISION

08/03/2015 – Added note that proof-of-concept code has been released publicly.

Mitigation for Client Binary Planting was removed due to inadvertent side effects. Customers that previously implemented that mitigation should recreate an empty SmcLU directory in the original location (for example, C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.6168.6000.105\SmcLu).