full-disclosure - Privilege escalation in McAfee VirusScanEnterprise 8.0i (patch 11) and CMA 3.5 (patch 5)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri Dec 23 04:58:29 2005
From: mattmurphy at kc.rr.com (Matthew Murphy)
Subject: Privilege escalation in
	McAfee	VirusScanEnterprise 8.0i (patch 11) and CMA 3.5 (patch 5)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Reed Arvin wrote:
> Sir,
> 
> On Windows 2000 operating systems the default permissions for the root
> of the OS drive is Everyone/Full Control. However, with Microsoft
> operating systems newer than Windows 2000 administrative privileges
> are necessary. Thank you for your comment.
> 
> Regards,
> Reed

As I addressed in my previous post:

http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/040558.html

this default ACL is itself a security risk.  Windows 2000 systems with
Everyone/Full Control permissions on the installation volume are
susceptible to search path attacks irrespective of this VirusScan
"vulnerability".

Windows 2000 workstations with default ACLs applied that are consistent
with those in MS02-064 are *NOT* susceptible to the attacks you describe.

While this is a weakness in the VirusScan code and it should be fixed,
it does not expose systems to privilege escalation attacks in any
real-world scenario where those systems have secure ACLs on the
involved directories (install volume root and program files) as I describe.

This issue amounts to sloppy coding and is not a realistically
exploitable attack unless your systems have permissions in place that
expose them to compromise as-is.  Your Windows 2000 system's default ACL
is an example of that, and is not a secure environment, VirusScan or no.

There's no reason to concern people needlessly by claiming that this
issue has any likelihood of broad impact.

Regards,
Matt Murphy

- --
"Social Darwinism: Try to make something idiot-proof,
nature will provide you with a better idiot."

                                -- Michael Holstein

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDq4O1fp4vUrVETTgRA8JPAJ4mgTjnxNIJV4tUYepOOP0cLGh0zgCgk9pL
/3KpevcghdEd8bN3LGuyKw0=
=joTP
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3436 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051222/22c5e399/smime-0001.bin