Home / vulnerabilities

PDF

symantecPwn.txt

Posted on 12 October 2006
Link

 

Symantec Antivirus Engine is prone to a local privilege escalation
vulnerability.

Two Device Drivers are affected: NAVEX15.sys, NAVENG.sys.

NAVEX15.sys

#LOW CONSTANT VALUE

PAGE:0004B611 sub edx, 222AD3h
PAGE:0004B617 push esi
PAGE:0004B618 jz short loc_4B63C

loc_4B63C:
mov edx, [ecx+3Ch]
PAGE:0004B63F test edx, edx
PAGE:0004B641 jz short loc_4B653
PAGE:0004B643 push 4
PAGE:0004B645 pop esi
PAGE:0004B646 cmp [eax+4], esi
PAGE:0004B649 jnz short loc_4B653
PAGE:0004B64B mov dword ptr [edx], 200h // No check

EDX= controlled.

#HIGH CONSTANT VALUE

PAGE:0004B61A push 4
PAGE:0004B61C pop esi
PAGE:0004B61D sub edx, esi
PAGE:0004B61F jnz short loc_4B653
PAGE:0004B621 mov edx, [ecx+3Ch]
PAGE:0004B624 test edx, edx
PAGE:0004B626 jz short loc_4B653
PAGE:0004B628 cmp [eax+4], esi
PAGE:0004B62B jnz short loc_4B653
PAGE:0004B62D mov dword ptr [edx], offset
sub_4B71B //No Check

EDX= controlled.

Attack vectors:
Symantec and Norton-antivirus products for Microsoft Platforms.

Exploits:
I have decided to release public exploit code for these flaws, in order
to show that every kernel memory overwritting can be exploited, even if
we are not controlling the values.

Six exploits, based on these flaws, are available for download at
www.reversemode.com



References:
http://securityresponse.symantec.com/avcenter/security/Content/2006.10.05a.html
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=417


Regards,
Rubén Santamarta.

----
www.reversemode.com

 

TOP