[NT] McAfee Network Associates ePolicy Orchestrator Agent Privilege Escalation

From: SecuriTeam (support_at_securiteam.com)
Date: 08/18/05

  • Next message: SecuriTeam: "[UNIX] ATutor Multiple XSS Vulnerabilities" 
    To: list@securiteam.com
Date: 18 Aug 2005 16:53:39 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      McAfee Network Associates ePolicy Orchestrator Agent Privilege Escalation
    ------------------------------------------------------------------------

    SUMMARY

    "McAfee Security ePolicy Orchestrator is an enterprise antivirus
    management tool. ePolicy Orchestrator is a policy driven deployment and
    reporting tool for enterprise administrators to effectively manage their
    desktop and server antivirus products."

    ePolicy Orchestrator Agent allows users to obtain files of other users
    without using the file permission.

    DETAILS

    Vulnerable Systems:
     * Network Associates ePolicy Orchestrator Agent version 3.5.0 (patch 3)

    The ePolicy Orchestrator Agent web server (which runs on TCP port 8081 by
    default and serves the McAfee Agent Activity Log) can be used to view
    files that exist on the same partition with LocalSystem level privileges.

    On a default windows installation the "C:\Documents and Settings\All
    Users\Application Data\Network Associates\Common Framework\Db" folder
    (which is created by the EPO agent and is the folder that serves as the
    web root for the McAfee Agent Activity Log) includes the NTFS permission
    Everyone/Full Control.

    By using the Junction tool (from SysInternals) available at
    <http://www.sysinternals.com/utilities/junction.html>
    http://www.sysinternals.com/utilities/junction.html one can create a sub
    folder in the EPO agent web root directory (as any user) that will allow
    any file on the same partition to be viewed with LocalSystem level
    privileges.

    Example:
     1. Logon to a machine running the EPO agent as any user.
     2. Using the Junction tool type the following command:
       junction "C:\Documents and Settings\All Users\Application Data\Network
    Associates\Common Framework\Db\Test" C:\
    This creates the equivalent of a virtual folder in the web server root
    named Test that points to C:\

     3. Use Internet Explorer to view a restricted file such as:
       http://127.0.0.1:8081/Test/WINDOWS/repair/sam

       The contents of the restricted file will be displayed thanks to the
    LocalSystem account.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:reedarvin@gmail.com> Reed
    Arvin.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] ATutor Multiple XSS Vulnerabilities"

    Relevant Pages