======= Summary ======= Name: Symantec Messaging Gateway - SSH with backdoor user account + privilege escalation to root due to very old Kernel Release Date: 30 November 2012 Reference: NGS00267 Discoverer: Ben Williams Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway 9.5.3-3 Risk: High Status: Published ======== TimeLine ======== Discovered: 18 April 2012 Released: 18 April 2012 Approved: 29 April 2012 Reported: 30 April 2012 Fixed: 27 August 2012 Published: 30 November 2012 =========== Description =========== I. VULNERABILITY ------------------------- Symantec Messaging Gateway 9.5.3-3 - SSH with backdoor user account + privilege escalation to root due to very old Kernel II. BACKGROUND ------------------------- Symantec Messaging Gateway 9.5.3-3 is the latest version, of their Email Security Appliance III. DESCRIPTION ------------------------- The "admin" SSH account has a restricted shell, and the password is set by the administrator during setup. However, there is another SSH account "support" which has a default password, which is not changed during installation, and does not seem to be mentioned in the Symantec documentation as far as I can see (Installation Guide, Administration Guide or Command-line Guide). This account has a very easy-to-guess password, but many administrators may not know it exists. Additionally, the Linux Kernel on the appliance has not been updated since late 2007 (almost 5 years) so suffers from multiple privilege escalation issues (as do other old packages on the operating system) so if SSH is accessible to an attacker, it is possible for them to login and escalate to root. ================= Technical Details ================= IV. PROOF OF CONCEPT ------------------------- Both the install wizard and the documentation prompt the administrator to change the password for the "admin" account, for both the UI and for SSH to the operating system. This admin account can SSH in to the appliance, with the new chosen password, and has a restricted shell environment where only certain application administration commands are possible. It is not possible to login as root. However, there is another account "support" which has a default password of "symantec" which is not mentioned anywhere in the installer or documentation (as far as I can see) and the password is not changed as part of the installation process. This account is able to login to the OS via SSH, and does not have a restricted shell environment. Additionally, the Linux Kernel is very old (2007) so suffers from multiple privilege escalation issues. [+] Results for kernel version 2.6.18-274.3.1.2.el5_sms Potential exploits: * Linux Kernel BCM Local Root Exploit CVE: CVE-2010-2959 Affects kernels: 2.6.0-2.6.36rc1 Exploits: http://www.exploit-db.com/exploits/14814 * Linux Kernel RDS protocol Local Root Exploit CVE: CVE-2010-3904 Affects kernels: 2.6.0-2.6.36rc8 Exploits: http://www.exploit-db.com/exploits/15285 * Linux Kernel econet_sendmsg() - half-nelson Local Root Exploit CVE: CVE-2010-3848 Affects kernels: 2.6.0-2.6.36.2 Exploits: http://www.exploit-db.com/exploits/17787 * Linux Kernel Unknown Local Root Exploit CVE: CVE-None Affects kernels: 2.6.18-2.6.20 Exploits: http://www.exploit-db.com/exploits/10613 * Linux Kernel sock_sendpage() (Wunderbar Emporium) Local Root Exploit CVE: CVE-2009-2692 Affects kernels: 2.6.0-2.6.31rc3 Exploits: http://www.exploit-db.com/exploits/9641 http://www.exploit-db.com/exploits/9545 http://www.exploit-db.com/exploits/9479 http://www.exploit-db.com/exploits/9436 http://www.exploit-db.com/exploits/9435 http://www.grsecurity.net/~spender/enlightenment.tgz * Linux Kernel pipe.c (MooseCox) Local Root Exploit CVE: CVE-2009-3547 Affects kernels: 2.6.0-2.6.32rc5 Exploits: http://www.exploit-db.com/exploits/10018 http://www.grsecurity.net/~spender/enlightenment.tgz * Linux Kernel ReiserFS xattr Local Root Exploit CVE: CVE-2010-1146 Affects kernels: 2.6.0-2.6.34rc3 Exploits: http://www.exploit-db.com/exploits/12130 * Linux Kernel vmsplice Local Root Exploit CVE: CVE-2008-0009 Affects kernels: 2.6.17-2.6.24.1 Exploits: http://www.exploit-db.com/exploits/5092 http://www.exploit-db.com/exploits/5093 * Linux Kernel ec_dev_ioctl() - half-nelson Local Root Exploit CVE: CVE-2010-3850 Affects kernels: 2.6.0-2.6.36.2 Exploits: http://www.exploit-db.com/exploits/17787 http://www.exploit-db.com/exploits/15704 * Linux Kernel ACPI custom_method Local Root Exploit CVE: CVE-2010-4347 Affects kernels: 2.6.0-2.6.37rc2 Exploits: http://www.exploit-db.com/exploits/15774 * Linux Kernel ftruncate()/open() Local Root Exploit CVE: CVE-2008-4210 Affects kernels: 2.6.0-2.6.22 Exploits: http://www.exploit-db.com/exploits/6851 * Linux Kernel put_user() - full-nelson Local Root Exploit CVE: CVE-2010-4258 Affects kernels: 2.6.0-2.6.37 Exploits: http://www.exploit-db.com/exploits/15704 * Linux Kernel sock_no_sendpage() - full-nelson Local Root Exploit CVE: CVE-2010-3849 Affects kernels: 2.6.0-2.6.37 Exploits: http://www.exploit-db.com/exploits/15704 * Linux Kernel ipc - half-nelson Local Root Exploit CVE: CVE-2010-4073 Affects kernels: 2.6.0-2.6.37rc1 Exploits: http://www.exploit-db.com/exploits/17787 * Linux Kernel SELinux/RHEL5 (Cheddar Bay) Local Root Exploit CVE: CVE-None Affects kernels: 2.6.9-2.6.30 Exploits: http://www.exploit-db.com/exploits/9208 http://www.exploit-db.com/exploits/9191 http://www.grsecurity.net/~spender/enlightenment.tgz * Linux Kernel exit_notify() Local Root Exploit CVE: CVE-2009-1337 Affects kernels: 2.6.0-2.6.29 Exploits: http://www.exploit-db.com/exploits/8369 * Linux Kernel system call emulation Local Root Exploit CVE: CVE-2007-4573 Affects kernels: 2.6.0-2.6.22.7 Exploits: http://www.exploit-db.com/exploits/4460 * Linux Kernel set_selection() UTF-8 Off By One Local Root Exploit CVE: CVE-2009-1046 Affects kernels: 2.6.0-2.6.28.3 Exploits: http://www.exploit-db.com/exploits/9083 =============== Fix Information =============== An updated version of the software has been released to address the vulnerability: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00 NCC Group Research http://www.nccgroup.com/research For more information please visit http://www.mimecast.com
This email message has been delivered safely and archived online by Mimecast.