Symantec AntiVirus IOCTL Kernel Privilege Escalation Vulnerability

Bugtraq ID:	20360
Class:	Design Error
CVE:	CVE-2006-4927
Remote:	No
Local:	Yes
Published:	Oct 05 2006 12:00AM
Updated:	Mar 19 2015 09:16AM
Credit:	Ruben Santamarta and iDefense are credited with the discovery of this vulnerability.
Vulnerable:	Symantec Web Security 3.0.1 build 3.01.68 Symantec Web Security 3.0.1 build 3.01.67 Symantec Web Security 3.0.1 build 3.01.63 Symantec Web Security 3.0.1 build 3.01.62 Symantec Web Security 3.0.1 build 3.01.61 Symantec Web Security 3.0.1 build 3.01.60 Symantec Web Security 3.0.1 build 3.01.59 Symantec Web Security 3.0.1 build 3.0.1.74 Symantec Web Security 3.0.1 build 3.0.1.72 Symantec Web Security 3.0.1 build 3.0.1.70 Symantec Web Security 3.0.1 .70 Symantec Web Security 3.0.1 Build 62 Symantec Web Security 3.0.1 Symantec Web Security 3.0 Symantec Web Security 2.5 Symantec Symantec AntiVirus for SMTP 3.1 build 3.1.7 Symantec Symantec AntiVirus for SMTP 3.0 build 3.0.0.29 Symantec Norton SystemWorks 2006 0 Symantec Norton SystemWorks 2005 Premier 0 Symantec Norton SystemWorks 2005 0 Symantec Norton SystemWorks 2004 Professional Edition Symantec Norton SystemWorks 2004 Symantec Norton SystemWorks 2003 Professional Edition Symantec Norton SystemWorks 2003 Symantec Norton SystemWorks 2002 Professional Edition Symantec Norton SystemWorks 2002 Symantec Norton SystemWorks 2001 Professional Edition Symantec Norton SystemWorks 2001 Symantec Norton System Works 2006 Symantec Norton System Works 2005 Premier Symantec Norton System Works 2005 11.0.9 Symantec Norton System Works 2005 11.0 Symantec Norton System Works 2005 Premier Symantec Norton Internet Security 2007 0 Symantec Norton Internet Security 2006 Professional Edition Symantec Norton Internet Security 2006 0 Symantec Norton Internet Security 2005 Professional Edition Symantec Norton Internet Security 2005 11.5.6 .14 Symantec Norton Internet Security 2005 11.0.9 Symantec Norton Internet Security 2005 11.0 Symantec Norton Internet Security 2005 Symantec Norton Internet Security 2004 Symantec Norton Internet Security 2003 Professional Edition Symantec Norton Internet Security 2003 6.0.4 .34 Symantec Norton Internet Security 2003 Symantec Norton Internet Security 2002 Professional Edition 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Norton Internet Security 2002 0 Symantec Norton Internet Security 2001 Professional Edition Symantec Norton Internet Security 2001 0 Symantec Norton AntiVirus Corporate Edition 8.0 Symantec Norton AntiVirus Corporate Edition 7.61 Symantec Norton AntiVirus Corporate Edition 7.51 Symantec Norton AntiVirus Corporate Edition 7.6 Symantec Norton AntiVirus Corporate Edition 7.5 Symantec Norton AntiVirus Corporate Edition 7.2 Symantec Norton AntiVirus Corporate Edition 7.0 Symantec Norton AntiVirus Corporate Edition 7.60.build 926 Symantec Norton Antivirus 2007 0 Symantec Norton AntiVirus 2006 Symantec Norton AntiVirus 2005 Professional Edition Symantec Norton AntiVirus 2005 11.0.9 + Symantec Norton Internet Security 2005 11.0.9 + Symantec Norton Internet Security 2005 + Symantec Norton System Works 2005 11.0.9 + Symantec Norton System Works 2005 Premier Symantec Norton AntiVirus 2005 11.0 Symantec Norton AntiVirus 2005 Symantec Norton AntiVirus 2004 Professional Edition Symantec Norton AntiVirus 2004 Symantec Norton AntiVirus 2003 Professional Edition Symantec Norton Antivirus 2003 0 Symantec Norton AntiVirus 2002 Professional Edition Symantec Norton AntiVirus 2002 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Norton AntiVirus 2001 Professional Edition Symantec Norton AntiVirus 2001 0 Symantec Norton AntiVirus 5.0 2 Symantec Norton AntiVirus 5.0 Symantec Norton AntiVirus 4.0 for NT Symantec Norton AntiVirus 2000 Symantec Norton AntiSpam 2004 + Symantec Norton Internet Security 2004 + Symantec Norton Internet Security 2004 Professional Edition Symantec Mail Security for SMTP 4.1 Symantec Mail Security for SMTP 4.0.2 Symantec Mail Security for SMTP 4.0 build 4.1.4.30 Symantec Mail Security for SMTP 4.0 build 4.0.5.66 Symantec Mail Security for SMTP 4.0 build 4.0.2 Symantec Mail Security for SMTP 4.0 Symantec Mail Security for SMTP 5.0 Symantec Mail Security for Microsoft Exchange 5.0 Symantec Mail Security for Microsoft Exchange 4.6.3 Symantec Mail Security for Microsoft Exchange 4.6 build 97 Symantec Mail Security for Microsoft Exchange 4.6 build 4.6.1.107 Symantec Mail Security for Microsoft Exchange 4.5 build 719 Symantec Mail Security for Microsoft Exchange 4.5 build 4.5.4.743 Symantec Mail Security for Microsoft Exchange 4.5 build 743 Symantec Mail Security for Microsoft Exchange 4.5 build 741 Symantec Mail Security for Microsoft Exchange 4.5 build 736 Symantec Mail Security for Microsoft Exchange 4.5 Symantec Mail Security for Microsoft Exchange 4.1 build 459 Symantec Mail Security for Microsoft Exchange 4.1 build 458 Symantec Mail Security for Microsoft Exchange 4.1 461 Symantec Mail Security for Microsoft Exchange 4.0 build 743 Symantec Mail Security for Microsoft Exchange 4.0 build 741 Symantec Mail Security for Microsoft Exchange 4.0 build 736 Symantec Mail Security for Microsoft Exchange 4.0 build 465 Symantec Mail Security for Microsoft Exchange 4.0 build 463 Symantec Mail Security for Microsoft Exchange 4.0 build 456 Symantec Mail Security for Microsoft Exchange 4.0 Symantec Mail Security for Domino 5.1 Symantec Mail Security for Domino 4.1.4 Symantec Mail Security for Domino 4.1 Symantec Mail Security for Domino 4.0.1 Symantec Mail Security for Domino 4.0 build 4.0.1 Symantec Mail Security for Domino 4.0 Symantec Client Security 3.1 .401 Symantec Client Security 3.1 .400 Symantec Client Security 3.1 .396 Symantec Client Security 3.1 .394 Symantec Client Security 3.0.2 .2021 Symantec Client Security 3.0.2 .2020 Symantec Client Security 3.0.2 .2011 Symantec Client Security 3.0.2 .2010 Symantec Client Security 3.0.2 .2002 Symantec Client Security 3.0.2 .2001 Symantec Client Security 3.0.2 .2000 Symantec Client Security 3.0 Symantec Client Security 2.0.5 build 1100 Symantec Client Security 2.0.3 MR3 b9.0.3.1000 Symantec Client Security 2.0.2 MR2 b9.0.2.1000 Symantec Client Security 2.0.1 MR1 b9.0.1.1000 Symantec Client Security 2.0 STM build 9.0.0.338 Symantec Client Security 2.0 (SCF 7.1) Symantec Client Security 2.0 Symantec Client Security 1.1.1 MR5 build 8.1.1.336 Symantec Client Security 1.1.1 MR4 build 8.1.1.329 Symantec Client Security 1.1.1 MR3 build 8.1.1.323 Symantec Client Security 1.1.1 MR2 build 8.1.1.319 Symantec Client Security 1.1.1 MR1 build 8.1.1.314a Symantec Client Security 1.1.1 build 393 Symantec Client Security 1.1.1 MR6 b8.1.1.266 Symantec Client Security 1.1.1 Symantec Client Security 1.1 STM b8.1.0.825a Symantec Client Security 1.1 Symantec Client Security 1.0.1 MR8 build 8.01.471 Symantec Client Security 1.0.1 MR7 build 8.01.464 Symantec Client Security 1.0.1 MR6 build 8.01.460 Symantec Client Security 1.0.1 MR5 build 8.01.457 Symantec Client Security 1.0.1 MR4 build 8.01.446 Symantec Client Security 1.0.1 MR3 build 8.01.434 Symantec Client Security 1.0.1 build 8.01.437 Symantec Client Security 1.0.1 MR9 b8.01.501 Symantec Client Security 1.0.1 MR2 b8.01.429c Symantec Client Security 1.0.1 MR1 b8.01.425a/b Symantec Client Security 1.0.1 Symantec Client Security 1.0 .0 b8.01.9378 Symantec Client Security 1.0 b8.01.9374 Symantec Client Security 1.0 Symantec Client Security 3.1 Symantec Brightmail Anti-Spam 6.0.4 Symantec Brightmail Anti-Spam 6.0.3 Symantec Brightmail Anti-Spam 6.0.2 Symantec Brightmail Anti-Spam 6.0.1 Symantec Brightmail Anti-Spam 6.0 Symantec Brightmail Anti-Spam 5.5 Symantec Brightmail Anti-Spam 4.0 Symantec AntiVirus Scan Engine 5.0.1 Symantec AntiVirus Scan Engine 4.3.12 Symantec AntiVirus Scan Engine 4.3.3 Symantec AntiVirus Scan Engine 4.3 build 4.3.8.29 Symantec AntiVirus Scan Engine 4.3 build 4.3.7.27 Symantec AntiVirus Scan Engine 4.3 build 4.3.3 Symantec AntiVirus Scan Engine 4.3 Symantec AntiVirus Scan Engine 4.1.8 Symantec AntiVirus Scan Engine 4.1 Symantec AntiVirus Scan Engine 4.0 Symantec AntiVirus Scan Engine 5.1 Symantec AntiVirus Scan Engine 5.0 Symantec AntiSpam for SMTP 3.1
Not Vulnerable:

Symantec AntiVirus IOCTL Kernel Privilege Escalation Vulnerability

Symantec AntiVirus is prone to a privilege-escalation vulnerability.

Local attackers can exploit this issue to corrupt memory and execute arbitrary code with kernel-level privileges. Successful exploits may facilitate a complete system compromise.

This issue affects only Symantec and Norton antivirus products running on Microsoft Windows NT, Windows 2000, and Windows XP.

Symantec AntiVirus IOCTL Kernel Privilege Escalation Vulnerability

The following exploits are available to demonstrate this issue:

• /data/vulnerabilities/exploits/exploit-NAVENG-222AD3.c
• /data/vulnerabilities/exploits/exploit-NAVEND-222AD7.c
• /data/vulnerabilities/exploits/exploit-NAVENG-222ADB.c
• /data/vulnerabilities/exploits/exploit-NAVEX15-222AD3.c
• /data/vulnerabilities/exploits/exploit-NAVEX15-222AD7.c
• /data/vulnerabilities/exploits/exploit-NAVEX15-222ADB.c

Symantec AntiVirus IOCTL Kernel Privilege Escalation Vulnerability

Solution:
Symantec has released security advisory SYM06-020 to address this issue. Please see the referenced advisory for more information.

This issue is addressed in NAVEX15.SYS and NAVENG.SYS version 20061.3.0.12 and later. The update can be retrieved through 'LiveUpdate' or through downloading 'Intelligent Updater'. The update is also included with the virus definitions of Oct 4, 2006 revision 9 and later.

Symantec AntiVirus IOCTL Kernel Privilege Escalation Vulnerability

References:

• Norton AntiVirus Product Homepage (Symantec)
  
• SYM06-020 - Symantec Device Driver Elevation of Privilege (Symantec)
  
• Symantec AntiVirus IOCTL Kernel Privilege Escalation Vulnerability (iDefense)
  
• [Reversemode Advisory] Symantec Antivirus Engine Privilege Escalation (Reversemode )
  
• iDefense Security Advisory 10.05.06: Symantec AntiVirus IOCTL Kernel Privilege E (iDefense Labs )