lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 4 Sep 2013 22:07:27 +0800
From: Aaron Lewis <>
Subject: [CVE-2013-5675] Symantec Endpoint Protection
	un-installation password bypass

Hi list,

A weakness has been revealed on SEP installation that allows user to
uninstall this product without previous knowledge of the
un-installation password.

Affected version:  12.1.2015.2015
Affected OS:       Windows XP

The MSI module would first try to retrieve password from registry, which is:
HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\SMC\\SmcInstData

If the operation succeeds, SEP would inquiry about the un-installation password.
However, the operation may fail under two circumstances,

1) the key doesn't exist
2) the process doesn't have the permission to read the key

On Windows XP, the registry hook implementation of Symantec Endpoint
Protection was incomplete. Albeit it forbids you from removing the SMC
keys, but alternating the permission on SMC keys still works.

In order to bypass the mechanism, the end user need to revoke all read
permission on SMC keys manually, which is:
HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\SMC

P.S: Administrator privilege is still required to remove this product!
P.P.S: Legal acknowledgement: This vulnerability has already been
reported this to Symantec Threat Response team, which is ignored.

Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists