exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Symantec Alert Management System HNDLRSVC Arbitrary Command Execution

Symantec Alert Management System HNDLRSVC Arbitrary Command Execution
Posted Jan 29, 2011
Authored by TELUS Security Labs | Site telussecuritylabs.com

An arbitrary program execution vulnerability exists in Symantec Alert Management System (AMS) service shipped with multiple Symantec products. The vulnerability could be exploited by remote unauthenticated attackers to execute arbitrary code with SYSTEM privileges.

tags | advisory, remote, arbitrary
advisories | CVE-2010-0110
SHA-256 | eee2169d996a231a38ee1755b3896a7774d1175ed44b33559666eb32ec79256f

Symantec Alert Management System HNDLRSVC Arbitrary Command Execution

Change Mirror Download
Symantec Alert Management System HNDLRSVC Arbitrary Command Execution

TSL ID: FSC20100727-01

1. Affected Software

Symantec Antivirus Corporate Edition 10.1.8.8000 and possibly prior
Symantec System Center 10.1.8.8000 and possibly prior

Reference: http://www.symantec.com/business/antivirus-corporate-edition

2. Vulnerability Summary

An arbitrary program execution vulnerability exists in Symantec Alert Management System (AMS) service shipped with multiple Symantec products. The vulnerability could be exploited by remote unauthenticated attackers to execute arbitrary code with SYSTEM privileges.

3. Vulnerability Analysis

The Alert Management System (AMS) component of Symantec Antivirus Corporate Edition installs an alert handler service, HNDLRSVC, that listens for commands from the AMS server. This service does not perform proper authentication checks before executing such commands. Remote unauthenticated attackers could exploit this vulnerability by sending a crafted packet via the MSGSYS.EXE service on port 38292/TCP. The Run Program command would allow executing arbitrary programs from a remote SMB share with SYSTEM privileges on the vulnerable system.


4. Vulnerability Detection

TELUS Security Labs has confirmed the vulnerability in:

Symantec Antivirus Corporate Edition 10.1.8.8000
Symantec System Center 10.1.8.8000

5. Workaround

Disable the AMS service, or update to the non-vulnerable version of Symantec Antivirus 11.x series which does not include the vulnerable AMS component.

6. Vendor Response

Patches have been made available by the vendor to eliminate this vulnerability:

http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_00

7. Disclosure Timeline

2009-07-31 Reported to the vendor
2009-08-03 Vendor response
2011-01-26 Coordinated public disclosure

8. Credits

Junaid Bohio of Vulnerability Research Team, TELUS Security Labs

9. References

CVE: CVE-2010-0110

Vendor: http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_00

http://telussecuritylabs.com/threats/show/FSC20100727-01

10. About TELUS Security Labs

TELUS Security Labs, formerly Assurent Secure Technologies is the leading provider of security research. Our research services include:

* Vulnerability Research
* Malware Research
* Signature Development
* Shellcode Exploit Development
* Application Protocols
* Product Security Testing
* Security Content Development (parsers, reports, alerts)

TELUS Security Labs provides a specialized portfolio of services to assist security product vendors with newly discovered commercial product vulnerabilities and malware attacks. Many of our services are provided on a subscription basis to reduce research costs for our customers. Over 50 of the world's leading security product vendors rely on TELUS Security Labs research.

http://telussecuritylabs.com
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close