Details of VAR-200402-0066

ID

VAR-200402-0066

CVE

CVE-2003-0994

TITLE

Symantec LiveUpdate Local Privilege Escalation Vulnerability

Trust: 0.9

sources: BID: 9401 // CNNVD: CNNVD-200402-002

DESCRIPTION

The GUI functionality for an interactive session in Symantec LiveUpdate 1.70.x through 1.90.x, as used in Norton Internet Security 2001 through 2004, SystemWorks 2001 through 2004, and AntiVirus and Norton AntiVirus Pro 2001 through 2004, AntiVirus for Handhelds v3.0, allows local users to gain SYSTEM privileges. Symantec LiveUpdate has been reported prone to a local privilege escalation vulnerability. This issue presents itself when a LiveUpdate interactive session is created. The privileges of the process, if different from the user, are not lowered. This may allow a local attacker to employ the vulnerable LiveUpdate component to spawn arbitrary executables with the privileges of the LiveUpdate process. Symantec LiveUpdate is a program used by a large number of Symantec application systems for automatic upgrades. When a non-privileged user logs in, a small window of \"there are Live Updates available, click here to run LiveUpdate\" will be displayed in the Windows task bar. If you click to run online automatic update, you will find LUALL.exe and LUCOMS~1 The .exe will run under the context of the user SYSTEM, click the Help button, and a \"LiveUpdate Help\" window will appear, click the file and open it, browse c:\windows\system32, and then you can run the cmd.exe program with SYSTEM permissions. Secure Network Operations, Inc. http://www.secnetops.com/research Strategic Reconnaissance Team research[at]secnetops[.]com Team Lead Contact kf[at]secnetops[.]com Spam Contact `rm -rf /`@snosoft.com Our Mission: ************************************************************************ Secure Network Operations offers expertise in Networking, Intrusion Detection Systems (IDS), Software Security Validation, and Corporate/Private Network Security. Our mission is to facilitate a secure and reliable Internet and inter-enterprise communications infrastructure through the products and services we offer. Basic Explanation ************************************************************************ High Level Description : LiveUpdate allows local users to become SYSTEM What to do : run LiveUpdate and apply latest patches. Basic Technical Details ************************************************************************ Proof Of Concept Status : SNO has proof of concept. Low Level Description : Symantec, the world leader in Internet security technology, provides a broad range of content and network security software and appliance solutions to individuals, enterprises and service providers. The company is a leading provider of client, gateway and server security solutions for virus protection, firewall and virtual private network, vulnerability management, intrusion detection, Internet content and email filtering, and remote management technologies and security services to enterprises and service providers around the world. Symantec's Norton brand of consumer security products is a leader in worldwide retail sales and industry awards. Headquartered in Cupertino, Calif., Symantec has worldwide operations in 36 countries. Symantec's Norton Internet Security 2004 provides essential protection from viruses, hackers, and privacy threats. This issue is similar to the issues that were uncovered in the Windows Help API by both Brett Moore and our SRT team in late 2003. Full details available at: http://www.secnetops.biz/research/SRT2004-01-09-1022.txt and http://www.secnetops.biz/research/SRT2004-01-09-1022.jpg Vendor Status : Symantec promptly attended to the issue and was very responsive during all phases of discovery / research and patching. Fixes are now available via LiveUpdate. Bugtraq URL : To be assigned. CVE candidate CAN-2003-0994. Disclaimer ---------------------------------------------------------------------- This advisory was released by Secure Network Operations,Inc. as a matter of notification to help administrators protect their networks against the described vulnerability. Exploit source code is no longer released in our advisories but can be obtained under contract.. Contact our sales department at sales[at]secnetops[.]com for further information on how to obtain proof of concept code. ---------------------------------------------------------------------- Secure Network Operations, Inc. || http://www.secnetops.com "Embracing the future of technology, protecting you."

Trust: 1.35

sources: NVD: CVE-2003-0994 // BID: 9401 // VULHUB: VHN-7819 // PACKETSTORM: 32501

AFFECTED PRODUCTS

vendor:	symantec	model:	norton internet security	scope:	eq	version:	2004	Trust: 1.9
vendor:	symantec	model:	norton system works	scope:	eq	version:	2004	Trust: 1.6
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	2001	Trust: 1.6
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	2.1	Trust: 1.6
vendor:	symantec	model:	norton system works	scope:	eq	version:	2002	Trust: 1.6
vendor:	symantec	model:	norton system works	scope:	eq	version:	2001	Trust: 1.6
vendor:	symantec	model:	windows liveupdate	scope:	eq	version:	1.70.x	Trust: 1.6
vendor:	symantec	model:	windows liveupdate	scope:	eq	version:	1.90.x	Trust: 1.6
vendor:	symantec	model:	norton system works	scope:	eq	version:	2003	Trust: 1.6
vendor:	symantec	model:	norton internet security	scope:	eq	version:	2003	Trust: 1.3
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	2004	Trust: 1.3
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	2002	Trust: 1.0
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	v3.0	Trust: 1.0
vendor:	symantec	model:	norton internet security	scope:	eq	version:	2001	Trust: 1.0
vendor:	symantec	model:	norton internet security	scope:	eq	version:	2002	Trust: 1.0
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	2003	Trust: 1.0
vendor:	symantec	model:	norton systemworks professional edition	scope:	eq	version:	2004	Trust: 0.3
vendor:	symantec	model:	norton systemworks	scope:	eq	version:	2004	Trust: 0.3
vendor:	symantec	model:	norton systemworks professional edition	scope:	eq	version:	2003	Trust: 0.3
vendor:	symantec	model:	norton systemworks	scope:	eq	version:	2003	Trust: 0.3
vendor:	symantec	model:	norton systemworks professional edition	scope:	eq	version:	2002	Trust: 0.3
vendor:	symantec	model:	norton systemworks	scope:	eq	version:	2002	Trust: 0.3
vendor:	symantec	model:	norton systemworks professional edition	scope:	eq	version:	2001	Trust: 0.3
vendor:	symantec	model:	norton systemworks	scope:	eq	version:	2001	Trust: 0.3
vendor:	symantec	model:	norton internet security professional edition	scope:	eq	version:	2004	Trust: 0.3
vendor:	symantec	model:	norton internet security professional edition	scope:	eq	version:	2003	Trust: 0.3
vendor:	symantec	model:	norton internet security	scope:	eq	version:	20036.0.4.34	Trust: 0.3
vendor:	symantec	model:	norton internet security professional edition	scope:	eq	version:	20020	Trust: 0.3
vendor:	symantec	model:	norton internet security	scope:	eq	version:	20020	Trust: 0.3
vendor:	symantec	model:	norton internet security professional edition	scope:	eq	version:	2001	Trust: 0.3
vendor:	symantec	model:	norton internet security	scope:	eq	version:	20010	Trust: 0.3
vendor:	symantec	model:	norton antivirus professional edition	scope:	eq	version:	2004	Trust: 0.3
vendor:	symantec	model:	norton antivirus professional edition	scope:	eq	version:	2003	Trust: 0.3
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	20030	Trust: 0.3
vendor:	symantec	model:	norton antivirus professional edition	scope:	eq	version:	2002	Trust: 0.3
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	20020	Trust: 0.3
vendor:	symantec	model:	norton antivirus professional edition	scope:	eq	version:	2001	Trust: 0.3
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	20010	Trust: 0.3
vendor:	symantec	model:	liveupdate	scope:	eq	version:	1.9	Trust: 0.3
vendor:	symantec	model:	liveupdate	scope:	eq	version:	1.8	Trust: 0.3
vendor:	symantec	model:	liveupdate	scope:	eq	version:	1.7	Trust: 0.3
vendor:	symantec	model:	antivirus for handhelds	scope:	eq	version:	3.0.0.194	Trust: 0.3
vendor:	symantec	model:	antivirus for handhelds	scope:	eq	version:	3.0	Trust: 0.3
vendor:	symantec	model:	norton antivirus corporate edition	scope:	ne	version:	7.6	Trust: 0.3
vendor:	symantec	model:	liveupdate	scope:	ne	version:	2.0	Trust: 0.3
vendor:	symantec	model:	java liveupdate	scope:	ne	version:	-	Trust: 0.3

sources: BID: 9401 // CNNVD: CNNVD-200402-002 // NVD: CVE-2003-0994

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2003-0994
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-200402-002
value:	HIGH
Trust: 0.6
VULHUB:	VHN-7819
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2003-0994
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
VULHUB:	VHN-7819
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-7819 // CNNVD: CNNVD-200402-002 // NVD: CVE-2003-0994

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2003-0994

THREAT TYPE

local

Trust: 1.0

sources: BID: 9401 // PACKETSTORM: 32501 // CNNVD: CNNVD-200402-002

TYPE

access verification error

Trust: 0.6

sources: CNNVD: CNNVD-200402-002

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-7819

EXTERNAL IDS

db:	NVD	id:	CVE-2003-0994	Trust: 2.1
db:	OSVDB	id:	3428	Trust: 1.7
db:	CNNVD	id:	CNNVD-200402-002	Trust: 0.7
db:	BUGTRAQ	id:	20040112 RE: SRT2004-01-9-1022 - SYMANTEC LIVEUPDATE ALLOWS LOCAL USERS TO BECOME SYSTEM	Trust: 0.6
db:	BUGTRAQ	id:	20040112 SRT2004-01-9-1022 - SYMANTEC LIVEUPDATE ALLOWS LOCAL USERS TO BECOME SYSTEM	Trust: 0.6
db:	BID	id:	9401	Trust: 0.4
db:	PACKETSTORM	id:	32501	Trust: 0.2
db:	VULHUB	id:	VHN-7819	Trust: 0.1

sources: VULHUB: VHN-7819 // BID: 9401 // PACKETSTORM: 32501 // CNNVD: CNNVD-200402-002 // NVD: CVE-2003-0994

REFERENCES

url:	http://www.secnetops.biz/research/srt2004-01-09-1022.txt	Trust: 1.8
url:	http://lists.grok.org.uk/pipermail/full-disclosure/2004-january/015510.html	Trust: 1.7
url:	http://www.osvdb.org/3428	Trust: 1.7
url:	http://marc.info/?l=bugtraq&m=107393473928245&w=2	Trust: 1.1
url:	http://marc.theaimsgroup.com/?l=bugtraq&m=107393473928245&w=2	Trust: 0.6
url:	http://www.symantec.com	Trust: 0.3
url:	/archive/1/349782	Trust: 0.3
url:	/archive/1/349521	Trust: 0.3
url:	http://www.secnetops.com,	Trust: 0.1
url:	http://www.secnetops.com/research	Trust: 0.1
url:	http://www.secnetops.com	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2003-0994	Trust: 0.1
url:	http://symantec.com/techsupp/files/lu/lu.html	Trust: 0.1
url:	http://www.secnetops.biz/research/srt2004-01-09-1022.jpg	Trust: 0.1

sources: VULHUB: VHN-7819 // BID: 9401 // PACKETSTORM: 32501 // CNNVD: CNNVD-200402-002 // NVD: CVE-2003-0994

CREDITS

Secure Network Operations※ research@secnetops.com

Trust: 0.6

sources: CNNVD: CNNVD-200402-002

SOURCES

db:	VULHUB	id:	VHN-7819
db:	BID	id:	9401
db:	PACKETSTORM	id:	32501
db:	CNNVD	id:	CNNVD-200402-002
db:	NVD	id:	CVE-2003-0994

LAST UPDATE DATE

2024-08-14T14:09:00.382000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-7819	date:	2016-10-18T00:00:00
db:	BID	id:	9401	date:	2009-07-12T00:56:00
db:	CNNVD	id:	CNNVD-200402-002	date:	2006-09-28T00:00:00
db:	NVD	id:	CVE-2003-0994	date:	2016-10-18T02:38:57.927

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-7819	date:	2004-02-03T00:00:00
db:	BID	id:	9401	date:	2004-01-12T00:00:00
db:	PACKETSTORM	id:	32501	date:	2004-01-12T15:22:00
db:	CNNVD	id:	CNNVD-200402-002	date:	2004-01-12T00:00:00
db:	NVD	id:	CVE-2003-0994	date:	2004-02-03T05:00:00