Multiple Symantec Products Intel Common Base Agent Remote Command Execution Vulnerability

Bugtraq ID:	34671
Class:	Input Validation Error
CVE:	CVE-2009-1429
Remote:	Yes
Local:	No
Published:	Apr 28 2009 12:00AM
Updated:	Aug 22 2011 06:10AM
Credit:	Tenable Network Security, working through the Zero Day Initiative (ZDI).
Vulnerable:	Symantec Endpoint Protection 11.0.2020 .56 (MR2-MP2) Symantec Endpoint Protection 11.0.2010 .25 (MR2-MP1) Symantec Endpoint Protection 11.0.2001 .10 (MR2-PP1) Symantec Endpoint Protection 11.0.2000 .1567 (MR2) Symantec Endpoint Protection 11.0.1005 .1428 (MR1-PP5) Symantec Endpoint Protection 11.0.1002 .1378 (MR1-PP2) Symantec Endpoint Protection 11.0.1000 .1375 (MR1) Symantec Endpoint Protection 11.0.781 .1287 (STM-PP1) Symantec Endpoint Protection 11.0.780 .1109 (STM) Symantec Endpoint Protection 11.0 MR2 Symantec Endpoint Protection 11.0 MR1 Symantec Endpoint Protection 11.0 Symantec Client Security 3.1.7 .7000 (MR7) Symantec Client Security 3.1.6 .6010 (MR6-MP1) Symantec Client Security 3.1.5 .5010 (MR5-MP1) Symantec Client Security 3.1.5 .5001 (MR5-PP1) Symantec Client Security 3.1.5 .5000 (MR5) Symantec Client Security 3.1.4 MR4 MP1 - build 4010 Symantec Client Security 3.1.4 .4000 (MR4) Symantec Client Security 3.1 .401 Symantec Client Security 3.1 .400 Symantec Client Security 3.1 .396 Symantec Client Security 3.1 .394 Symantec Client Security 3.0.2 .2021 Symantec Client Security 3.0.2 .2020 Symantec Client Security 3.0.2 .2011 Symantec Client Security 3.0.2 .2010 Symantec Client Security 3.0.2 .2002 Symantec Client Security 3.0.2 .2001 Symantec Client Security 3.0.2 .2000 Symantec Client Security 3.0.1 .1009 (MR1-PP9) Symantec Client Security 3.0.1 .1003 (MR1-PP2) Symantec Client Security 2.0.6 MR6 MP1 - build 1100 Symantec Client Security 2.0.6 MR6 Symantec Client Security 2.0.6 .1000 (MR6) Symantec Client Security 2.0.5 build 1100 Symantec Client Security 2.0.5 .1001 (MR5-PP1) Symantec Client Security 2.0.5 .1000 (MR5) Symantec Client Security 2.0.4 MR4 build 1000 Symantec Client Security 2.0.4 Symantec Client Security 2.0.3 .1000 (MR3) Symantec Client Security 2.0.2 .1000 (MR2) Symantec Client Security 2.0.1 .1100 (MR1-MP1) Symantec Client Security 2.0.1 .1001 (MR1-PP1) Symantec Client Security 2.0.1 .1000 (MR1) Symantec Client Security 2.0 .338 (STM) Symantec Client Security 2.0 .1400 (STM-PP2) Symantec Client Security 2.0 .1300 (STM-PP1) Symantec Client Security 3.1.6.6000 Symantec Client Security 3.1 MR7 Symantec Client Security 3.1 MR6 MP1 Symantec Client Security 3.1 MR6 Symantec Client Security 3.1 Symantec Client Security 3.0.1.1008 Symantec Client Security 3.0.1.1007 Symantec Client Security 3.0.1.1001 Symantec Client Security 3.0.1.1000 Symantec Client Security 3.0.0.359 Symantec Client Security 2.0 MR6 MP1 Symantec AntiVirus Corporate Edition 10.2.1 .1000 (MR1) Symantec AntiVirus Corporate Edition 10.2 .313 (STM-PP1) Symantec AntiVirus Corporate Edition 10.2 .298 (STM 64-bit) Symantec AntiVirus Corporate Edition 10.2 .276 (STM 32-bit) Symantec AntiVirus Corporate Edition 10.1.7 .7000 (MR7) Symantec AntiVirus Corporate Edition 10.1.6 .6010 (MR6-MP1) Symantec AntiVirus Corporate Edition 10.1.5 .5010 (MR5-MP1) Symantec AntiVirus Corporate Edition 10.1.5 .5001 (MR5-PP1) Symantec AntiVirus Corporate Edition 10.1.5 .5000 (MR5) Symantec AntiVirus Corporate Edition 10.1.4 MR4 MP1 - build 4010 Symantec AntiVirus Corporate Edition 10.1.4 .4000 (MR4) Symantec AntiVirus Corporate Edition 10.1.4 Symantec AntiVirus Corporate Edition 10.1 .401 Symantec AntiVirus Corporate Edition 10.1 .400 Symantec AntiVirus Corporate Edition 10.1 .396 Symantec AntiVirus Corporate Edition 10.1 .394 Symantec AntiVirus Corporate Edition 10.0.2 .2021 Symantec AntiVirus Corporate Edition 10.0.2 .2020 Symantec AntiVirus Corporate Edition 10.0.2 .2011 Symantec AntiVirus Corporate Edition 10.0.2 .2010 Symantec AntiVirus Corporate Edition 10.0.2 .2002 Symantec AntiVirus Corporate Edition 10.0.2 .2001 Symantec AntiVirus Corporate Edition 10.0.2 .2000 Symantec AntiVirus Corporate Edition 10.0.1 .1009 (MR1-PP9) Symantec AntiVirus Corporate Edition 10.0.1 .1003 (MR1-PP2) Symantec AntiVirus Corporate Edition 10.0.1 .1001 (MR1-PP1) Symantec AntiVirus Corporate Edition 9.0.6 MR6 MP1 - build 1100 Symantec AntiVirus Corporate Edition 9.0.6 .1000 (MR6) Symantec AntiVirus Corporate Edition 9.0.5 .1100 Symantec AntiVirus Corporate Edition 9.0.5 .1001 (MR5-PP1) Symantec AntiVirus Corporate Edition 9.0.5 .1000 (MR5) Symantec AntiVirus Corporate Edition 9.0.5 Symantec AntiVirus Corporate Edition 9.0.4 MR4 build 1000 Symantec AntiVirus Corporate Edition 9.0.4 Symantec AntiVirus Corporate Edition 9.0.3 .1100 (MR3-MP1) Symantec AntiVirus Corporate Edition 9.0.3 .1000 Symantec AntiVirus Corporate Edition 9.0.2 .1000 Symantec AntiVirus Corporate Edition 9.0.1 .1100 (MR1-MP1) Symantec AntiVirus Corporate Edition 9.0.1 .1001 (MR1-PP1) Symantec AntiVirus Corporate Edition 9.0.1 .1000 (MR1) Symantec AntiVirus Corporate Edition 9.0 .1400 (STM-PP2) Symantec AntiVirus Corporate Edition 9.0 .1300 (STM-PP1) Symantec AntiVirus Corporate Edition 9.0 .0.338 Symantec AntiVirus Corporate Edition 9.0.6.1000 Symantec AntiVirus Corporate Edition 9 MR6 MP1 Symantec AntiVirus Corporate Edition 10.2 MR1 Symantec AntiVirus Corporate Edition 10.2 Symantec AntiVirus Corporate Edition 10.1.6.6000 Symantec AntiVirus Corporate Edition 10.1.6.600 Symantec AntiVirus Corporate Edition 10.1.4.4010 Symantec AntiVirus Corporate Edition 10.1 MR7 Symantec AntiVirus Corporate Edition 10.1 MR6 MP1 Symantec AntiVirus Corporate Edition 10.1 MR6 Symantec AntiVirus Corporate Edition 10.1 Symantec AntiVirus Corporate Edition 10.0.1.1008 Symantec AntiVirus Corporate Edition 10.0.1.1007 Symantec AntiVirus Corporate Edition 10.0.1.1000 Symantec AntiVirus Corporate Edition 10.0.0.359
Not Vulnerable:	Symantec Endpoint Protection 11.0.4010 .26 (MR4-MP1a) Symantec Endpoint Protection 11.0.4010 .19 (MR4-MP1) Symantec Endpoint Protection 11.0.4000 .2295 (MR4) Symantec Endpoint Protection 11.0.3001 .2224 (MR3) Symantec Endpoint Protection 11.0 MR3 Symantec Client Security 3.1 MR8 Symantec Client Security 2.0 MR7 Symantec AntiVirus Corporate Edition 9.0 MR7 Symantec AntiVirus Corporate Edition 10.2 MR2 Symantec AntiVirus Corporate Edition 10.1 MR8

Multiple Symantec Products Intel Common Base Agent Remote Command Execution Vulnerability

The AMS2 (Alert Management Systems 2) component of multiple Symantec products is prone to a remote command-execution vulnerability because the software fails to adequately sanitize user-supplied input.

Successfully exploiting this issue will allow an attacker to execute arbitrary commands with SYSTEM-level privileges, completely compromising affected computers. Failed exploit attempts will result in a denial-of-service condition.

Multiple Symantec Products Intel Common Base Agent Remote Command Execution Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

Symantec has detected active exploit attempts of this issue in the wild.

The following exploits are available:

• /data/vulnerabilities/exploits/34671.rb
• /data/vulnerabilities/exploits/34671-2.pl
• /data/vulnerabilities/exploits/34671-2.rb

Multiple Symantec Products Intel Common Base Agent Remote Command Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Multiple Symantec Products Intel Common Base Agent Remote Command Execution Vulnerability

References:

• Symantec Homepage (Symantec)
  
• SYM09-007 Security Advisories Relating to Symantec Products - Symantec Alert Man (Symantec)