lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 28 Mar 2014 11:43:30 +0200
From: SEC Consult Vulnerability Lab <>
To: <>, <>
Subject: [FD] SEC Consult SA-20140328-0 :: Multiple vulnerabilities in
 Symantec LiveUpdate Administrator

SEC Consult Vulnerability Lab Security Advisory < 20140328-0 >
              title: Multiple critical vulnerabilities
            product: Symantec LiveUpdate Administrator
 vulnerable version: <=
      fixed version:
             impact: critical
         CVE number: CVE-2014-1644, CVE-2014-1645
              found: 2014-01-02
                 by: Stefan Viehböck
                     SEC Consult Vulnerability Lab

Vendor description:
"LiveUpdate Administrator is an enterprise Web application that allows you to
manage updates on multiple internal Central Update servers, called Distribution
Centers. Using LiveUpdate Administrator, you download updates to the Manage
Updates folder, and then send the updates to production distribution servers
for Update clients to download, or to testing distribution centers, so that the
updates can be tested before they are distributed to production.


Business recommendation:
Attackers are able to compromise LiveUpdate Administrator at the
application and database levels. This enables access to credentials of update
servers on the network.

It is highly recommended by SEC Consult not to use this software until a
thorough security review has been performed by security professionals and all
identified issues have been resolved.

Vulnerability overview/description:
1) Unauthenticated arbitrary account password reset (CVE-2014-1644)
The reset password is not properly protected and allows unauthenticated
attackers to reset passwords of arbitrary users.
Using this vulnerability an attacker can gain full access to the LiveUpdate
Administrator web interface.
An attacker can use this vulnerability to retrieve usernames/passwords of
internal LiveUpdate servers and execute attacks against those servers.

2) Unauthenticated SQL injection (CVE-2014-1645)
Several SQL injection vulnerabilities were discovered in the application.
These vulnerabilities allow attackers to exfiltrate database contents
(including user names, passwords, server credentials) and possibly to
compromise the host system as well.

Proof of concept:
1) Unauthenticated arbitrary account password reset (CVE-2014-1644)
The following request shows how the password of the user with the email address
"" can be set to "11111111".
Affected script: /lua/

Detailed proof of concept exploits have been removed for this vulnerability.

2) Unauthenticated SQL injection (CVE-2014-1645)
The following request shows how the SQL injection in the password reset
functionality can be exploited (blind, timing).
Affected script: /lua/

Detailed proof of concept exploits have been removed for this vulnerability.

The password recovery functionality (/loginforgotpwd)is vulnerable to SQL
injection as well. Several DAO methods show incorrect use of prepared
statements and were not investigated further.

Vulnerable / tested versions:
The vulnerabilities have been verified to exist in Symantec LiveUpdate
Administrator version 12.1.4013, which was the most recent version at the time
of discovery.

Vendor contact timeline:
2014-01-09: Sending advisory and proof of concept exploit via encrypted
2014-01-09: Vendor acknowledges receipt of advisory.
2014-02-24: Requesting status update.
2014-02-25: Vendor confirms vulnerability.
2014-02-25: Vendor plans release in late march.
2014-03-25: Vendor provides schedule.
2014-03-27: Vendor provides CVE-IDs and releases fixed version.
2014-03-28: SEC Consult releases coordinated security advisory.

Update to the most recent version ( of Symantec LiveUpdate

More information can be found at:

No workaround available.

Advisory URL:

SEC Consult Vulnerability Lab

SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius

Mooslackengasse 17, 1190 Vienna, Austria
Phone:   +43 1 8903043 0
Fax:     +43 1 8903043 15

Mail: research at sec-consult dot com

Interested to work with the experts of SEC Consult?
Write to

EOF Stefan Viehböck / @2014

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists