SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

Symantec Antivirus Engine Privilege Escalation


Arrow  SecurityAlert : 1690
Arrow  CVE : CVE-2006-4927
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : No
Arrow  Local Exploit : Yes
Arrow  Exploit Available : Yes
Arrow  Credit : Rubén Santamarta
Arrow  Published : 10.10.2006

Arrow  Affected Software : Norton AntiVirus
Norton Internet Security
Norton System Works
Symantec AntiVirus Corporate Edition
Symantec AntiVirus for Blue Coat Security
Symantec AntiVirus for CacheFlow Security Gateway
Symantec AntiVirus for Clearswift MIME Sweeper
Symantec AntiVirus for Inktomi Traffic Edge
Symantec AntiVirus for Microsoft ISA Server
Symantec AntiVirus for NetApp Filer/NetCache
Symantec BrightMail AntiSpam
Symantec Client Security
Symantec Mail Security for Domino
Symantec Mail Security for Exchange
Symantec Mail Security for SMTP
Symantec Scan Engine
Symantec Web Security for Windows



Arrow  Advisory Content :  


Symantec Antivirus Engine is prone to a local privilege escalation
vulnerability.

Two Device Drivers are affected: NAVEX15.sys, NAVENG.sys.

NAVEX15.sys

#LOW CONSTANT VALUE

PAGE:0004B611 sub edx, 222AD3h
PAGE:0004B617 push esi
PAGE:0004B618 jz short loc_4B63C

loc_4B63C:
mov edx, [ecx+3Ch]
PAGE:0004B63F test edx, edx
PAGE:0004B641 jz short loc_4B653
PAGE:0004B643 push 4
PAGE:0004B645 pop esi
PAGE:0004B646 cmp [eax+4], esi
PAGE:0004B649 jnz short loc_4B653
PAGE:0004B64B mov dword ptr [edx], 200h // No check

EDX= controlled.

#HIGH CONSTANT VALUE

PAGE:0004B61A push 4
PAGE:0004B61C pop esi
PAGE:0004B61D sub edx, esi
PAGE:0004B61F jnz short loc_4B653
PAGE:0004B621 mov edx, [ecx+3Ch]
PAGE:0004B624 test edx, edx
PAGE:0004B626 jz short loc_4B653
PAGE:0004B628 cmp [eax+4], esi
PAGE:0004B62B jnz short loc_4B653
PAGE:0004B62D mov dword ptr [edx], offset
sub_4B71B //No Check

EDX= controlled.

Attack vectors:
Symantec and Norton-antivirus products for Microsoft Platforms.

Exploits:
I have decided to release public exploit code for these flaws, in order
to show that every kernel memory overwritting can be exploited, even if
we are not controlling the values.

Six exploits, based on these flaws, are available for download at
www.reversemode.com

References:
http://securityresponse.symantec.com/avcenter/security/Content/2006.10.0
5a.html
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=417

Regards,
Rubén Santamarta.

----
www.reversemode.com




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc/fnmatch(3) DoS

Security Risk Medium- 2011-05-13

Allow attacker to denial of service apache 2.2.17 server
Apache RSS Apache Alert

» Apache HTTP Server Denial
   of Service Vulnerability

» Multiple Vendors
   libc/fnmatch(3) DoS (incl
   apache poc)

» Apache Continuum
   cross-site scripting
   vulnerability

» Apache Tomcat DoS
   Vulnerability
PHP RSS PHP Alert

» PHP Hashtables Denial of
   Service

» PHP 5.3.6 multiple null
   pointer dereference

» PHP 5.3.6 ZipArchive
   invalid use glob(3)

» libzip 0.9.3
   _zip_name_locate NULL
   Pointer Dereference (incl
   PHP 5.3.5)
ADT

Protect your family and valuables with Home Security Systems
Copyright © SecurityReason.com. All Rights Reserved.