full-disclosure - [CVE-2013-5675] Symantec Endpoint Protection un-installation password bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAJZVxRnh2pU0UiKqn9SiYfJMtmOZT2LaZirb2cMWpnVtSV6R7A@mail.gmail.com>
Date: Wed, 4 Sep 2013 22:07:27 +0800
From: Aaron Lewis <the.warl0ck.1989@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: [CVE-2013-5675] Symantec Endpoint Protection
	un-installation password bypass

Hi list,

Description:
---------------------------------------------
A weakness has been revealed on SEP installation that allows user to
uninstall this product without previous knowledge of the
un-installation password.

Affected version:  12.1.2015.2015
Affected OS:       Windows XP

Details:
---------------------------------------------
The MSI module would first try to retrieve password from registry, which is:
HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\SMC\\SmcInstData

If the operation succeeds, SEP would inquiry about the un-installation password.
However, the operation may fail under two circumstances,

1) the key doesn't exist
2) the process doesn't have the permission to read the key

On Windows XP, the registry hook implementation of Symantec Endpoint
Protection was incomplete. Albeit it forbids you from removing the SMC
keys, but alternating the permission on SMC keys still works.

In order to bypass the mechanism, the end user need to revoke all read
permission on SMC keys manually, which is:
HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\SMC

P.S: Administrator privilege is still required to remove this product!
P.P.S: Legal acknowledgement: This vulnerability has already been
reported this to Symantec Threat Response team, which is ignored.

-- 
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/