Symantec Intel Alert Management System Message Handling Multiple Code Execution Vulnerabilities

Bugtraq ID:	45935
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2010-0111
Remote:	Yes
Local:	No
Published:	Jan 26 2011 12:00AM
Updated:	Mar 14 2011 04:17PM
Credit:	Junaid Bohio of Vulnerability Research Team,Telus Security Labs, an anonymous reporter through Tippingpoint�??s Zero Day Initiative(ZDI), and Jorge Lucangeli Obes of CORE Security
Vulnerable:	Symantec Quarantine Server 3.6 Symantec Quarantine Server 3.5 Symantec AntiVirus Corporate Edition 10.1.7 .7000 (MR7) Symantec AntiVirus Corporate Edition 10.1.6 .6010 (MR6-MP1) Symantec AntiVirus Corporate Edition 10.1.5 .5010 (MR5-MP1) Symantec AntiVirus Corporate Edition 10.1.5 .5001 (MR5-PP1) Symantec AntiVirus Corporate Edition 10.1.5 .5000 (MR5) Symantec AntiVirus Corporate Edition 10.1.4 MR4 MP1 - build 4010 Symantec AntiVirus Corporate Edition 10.1.4 .4000 (MR4) Symantec AntiVirus Corporate Edition 10.1.4 Symantec AntiVirus Corporate Edition 10.1 .401 Symantec AntiVirus Corporate Edition 10.1 .400 Symantec AntiVirus Corporate Edition 10.1 .396 Symantec AntiVirus Corporate Edition 10.1 .394 Symantec AntiVirus Corporate Edition 10.0.2 .2021 Symantec AntiVirus Corporate Edition 10.0.2 .2020 Symantec AntiVirus Corporate Edition 10.0.2 .2011 Symantec AntiVirus Corporate Edition 10.0.2 .2010 Symantec AntiVirus Corporate Edition 10.0.2 .2002 Symantec AntiVirus Corporate Edition 10.0.2 .2001 Symantec AntiVirus Corporate Edition 10.0.2 .2000 Symantec AntiVirus Corporate Edition 10.0.1 .1009 (MR1-PP9) Symantec AntiVirus Corporate Edition 10.0.1 .1003 (MR1-PP2) Symantec AntiVirus Corporate Edition 10.0.1 .1001 (MR1-PP1) Symantec AntiVirus Corporate Edition 10.0 Symantec AntiVirus Corporate Edition 10.1.8.8000 Symantec AntiVirus Corporate Edition 10.1.6.6000 Symantec AntiVirus Corporate Edition 10.1.6.600 Symantec AntiVirus Corporate Edition 10.1.4.4010 Symantec AntiVirus Corporate Edition 10.1 MR9 Symantec AntiVirus Corporate Edition 10.1 MR8 Symantec AntiVirus Corporate Edition 10.1 MR7 Symantec AntiVirus Corporate Edition 10.1 MR6 MP1 Symantec AntiVirus Corporate Edition 10.1 MR6 Symantec AntiVirus Corporate Edition 10.1 Symantec AntiVirus Corporate Edition 10.0.1.1008 Symantec AntiVirus Corporate Edition 10.0.1.1007 Symantec AntiVirus Corporate Edition 10.0.1.1000 Symantec AntiVirus Corporate Edition 10.0.0.359 Symantec AntiVirus 10
Not Vulnerable:	Symantec AntiVirus Corporate Edition 10.1 MR10

Symantec Intel Alert Management System Message Handling Multiple Code Execution Vulnerabilities

Symantec Intel Alert Management System is prone to multiple remote code-execution vulnerabilities due to improper message handling.

Attackers can exploit these issues to execute arbitrary code in the context of the affected application. Other attacks are also possible.

Symantec Intel Alert Management System Message Handling Multiple Code Execution Vulnerabilities

Some of these issues may be trivial to exploit and may not require specific exploit code.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Symantec Intel Alert Management System Message Handling Multiple Code Execution Vulnerabilities

Solution:
Updates are available. Please contact the vendor for more information.

Symantec Intel Alert Management System Message Handling Multiple Code Execution Vulnerabilities

References:

• Symantec Homepage (Symantec Corp.)
  
• TELUS Security Labs VR - Symantec Antivirus Intel Alert Handler Service Deni ([email protected])
  
• FSC20101213-06 Telus Security Labs Symantec Antivirus Intel Alert Handler Servic (Telus Security Labs)
  
• Security Advisories Relating to Symantec Products - Multiple Symantec Intel Aler (Symantec)
  
• ZDI-11-029 Symantec AMS Intel Alert Handler Service CreateProcess Remote Code Ex (Zero Day Initiative)
  
• ZDI-11-030 Symantec AMS Intel Alert Handler Modem String Parsing Remote Code Exe (Zero Day Initiative)
  
• ZDI-11-031 Symantec AMS Intel Alert Handler Pin Number Parsing Remote Code Execu (Zero Day Initiative)
  
• ZDI-11-032 Symantec Intel Alert Originator Service iao.exe Remote Code Execution (Zero Day Initiative)