Symantec LiveUpdate Local Privilege Escalation Vulnerability

Bugtraq ID:	9401
Class:	Access Validation Error
CVE:	CVE-2003-0994
Remote:	No
Local:	Yes
Published:	Jan 12 2004 12:00AM
Updated:	Jul 12 2009 12:56AM
Credit:	Discovery credited to KF.
Vulnerable:	Symantec Norton SystemWorks 2004 Professional Edition Symantec Norton SystemWorks 2004 Symantec Norton SystemWorks 2003 Professional Edition Symantec Norton SystemWorks 2003 Symantec Norton SystemWorks 2002 Professional Edition Symantec Norton SystemWorks 2002 Symantec Norton SystemWorks 2001 Professional Edition Symantec Norton SystemWorks 2001 Symantec Norton Internet Security 2004 Professional Edition Symantec Norton Internet Security 2004 Symantec Norton Internet Security 2003 Professional Edition Symantec Norton Internet Security 2003 6.0.4 .34 Symantec Norton Internet Security 2003 Symantec Norton Internet Security 2002 Professional Edition 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Norton Internet Security 2002 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Norton Internet Security 2001 Professional Edition Symantec Norton Internet Security 2001 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Norton AntiVirus 2004 Professional Edition Symantec Norton AntiVirus 2004 Symantec Norton AntiVirus 2003 Professional Edition Symantec Norton Antivirus 2003 0 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Norton AntiVirus 2002 Professional Edition Symantec Norton AntiVirus 2002 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Norton AntiVirus 2001 Professional Edition Symantec Norton AntiVirus 2001 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 b - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 3.5.1 SP5 - Microsoft Windows NT 3.5.1 SP3 - Microsoft Windows NT 3.5.1 SP2 - Microsoft Windows NT 3.5.1 SP1 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 3.5 Symantec LiveUpdate 1.9 Symantec LiveUpdate 1.8 Symantec LiveUpdate 1.7 + Symantec Norton AntiVirus 2001 0 + Symantec Norton AntiVirus 2002 0 + Symantec Norton AntiVirus Corporate Edition 7.6 Symantec AntiVirus for Handhelds 3.0 .0.194 Symantec AntiVirus for Handhelds 3.0
Not Vulnerable:	Symantec Norton AntiVirus Corporate Edition 7.6 Symantec LiveUpdate 2.0 Symantec Java LiveUpdate

Symantec LiveUpdate Local Privilege Escalation Vulnerability

Symantec LiveUpdate has been reported prone to a local privilege escalation vulnerability. This issue presents itself when a LiveUpdate interactive session is created. The privileges of the process, if different from the user, are not lowered. This may allow a local attacker to employ the vulnerable LiveUpdate component to spawn arbitrary executables with the privileges of the LiveUpdate process.

Symantec LiveUpdate Local Privilege Escalation Vulnerability

An exploit has been developed by the researchers who discovered this vulnerability. This exploit is not believed to be publicly available.

Symantec LiveUpdate Local Privilege Escalation Vulnerability

Solution:
Symantec have made fixes to address this issue available over the LiveUpdate service. Customers who are potentially affected by this vulnerability are advised to run LiveUpdate as soon as possible. To update using LiveUpdate, customers should select the LiveUpdate option within your retail Symantec product and download and install all available updates. For customers who do not wish to use the LiveUpdate capability, fixes are linked below.


Symantec LiveUpdate 1.7

• Symantec Symantec Windows LiveUpdate 2.0
  http://www.symantec.com/techsupp/files/lu/lu.html

Symantec LiveUpdate 1.8

• Symantec Symantec Windows LiveUpdate 2.0
  http://www.symantec.com/techsupp/files/lu/lu.html

Symantec LiveUpdate 1.9

• Symantec Symantec Windows LiveUpdate 2.0
  http://www.symantec.com/techsupp/files/lu/lu.html

Symantec LiveUpdate Local Privilege Escalation Vulnerability

References:

• Symantec Homepage (Symantec)
  
• Re: SRT2004-01-9-1022 - Symantec LiveUpdate allows local users to become (Sym Security )
  
• SRT2004-01-9-1022 - Symantec LiveUpdate allows local users to become SYSTEM (KF )