========================================================================= Team Intell Security Advisory TISA2007-13-Public ------------------------------------------------------------------------- Multiple eScan products insecure file permissions ========================================================================= Release date: 30.08.2007 Severity: Moderately critical Impact: Privilege escalation Remote: No Status: Unpatched Software: eScan Virus Control 9.0.722.1 eScan Anti-Virus 9.0.722.1 eScan Internet Security 9.0.722.1 Tested on: Microsoft Windows XP SP2 Vendor: http://www.mwti.net/ Disclosed by: Edi Strosar (Team Intell) Vendor's description of affected application(s): ================================================ "eScan is the latest offering from MicroWorld Technologies Inc. It offers a combination of features to help you fight the threat of viruses, set security policies for parental control over content accessed by your child. It guards against Internet misuse, block spam and offensive mails and block popup ads." Download link: http://www.mwti.net/products/download_center.asp Analysis: ========= eScan product line is prone to security issue which can be exploited by LUA users to gain escalated privileges. The problem is caused due to the application setting insecure default permissions (grants Everyone:Full Control) on the eScan installation directory and all it's child objects. This can be exploited to remove, manipulate, and replace any of the application's files. Successful exploitation allows execution of arbitrary code with SYSTEM privileges. Proof of concept: ================= - logon as LUA user - rename traysser.exe to traysser.exe.BAK - copy program.exe to eScan installation directory - rename program.exe to traysser.exe - restart the computer - "rootshell" ;) NOTE: traysser.exe is eScan Server Updater Service that runs as NT AUTHORITYSYSTEM. Tested on multiple eScan products v9.0.722.1. Other products/versions may be affected. Source code for program.exe: ============================ #include <stdio.h> int main() { system("cmd.exe"); return 0; } Solution: ========= Set proper permissions on the eScan installation directory and all it's child objects. NOTE: this may impact the functionality. Timeline: ========= 10.08.2007 - initial vendor notification 20.08.2007 - additional vendor notification 30.08.2007 - public disclosure Contact: ======== Maldin d.o.o. Trzaska cesta 2 1000 Ljubljana - SI tel: +386 (0)590 70 170 fax: +386 (0)590 70 177 gsm: +386 (0)31 816 400 web: www.teamintell.com e-mail: info at teamintell.com Disclaimer: =========== The content of this report is purely informational and meant for educational purposes only. Maldin d.o.o. shall in no event be liable for any damage whatsoever, direct or implied, arising from use or spread of this information. Any use of information in this advisory is entirely at user's own risk. =========================================================================