Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:28783
HistoryDec 02, 2012 - 12:00 a.m.

NGS000267 Technical Advisory: Symantec Messaging Gateway SSH with backdoor user account plus privilege escalation to root due to very old Kernel

2012-12-0200:00:00
vulners.com
48

=======
Summary

Name: Symantec Messaging Gateway - SSH with backdoor user account + privilege escalation to root due to very old Kernel
Release Date: 30 November 2012
Reference: NGS00267
Discoverer: Ben Williams <[email protected]>
Vendor: Symantec
Vendor Reference:
Systems Affected: Symantec Messaging Gateway 9.5.3-3
Risk: High
Status: Published

========
TimeLine

Discovered: 18 April 2012
Released: 18 April 2012
Approved: 29 April 2012
Reported: 30 April 2012
Fixed: 27 August 2012
Published: 30 November 2012

===========
Description

I. VULNERABILITY

Symantec Messaging Gateway 9.5.3-3 - SSH with backdoor user account + privilege escalation to root due to very old Kernel

II. BACKGROUND

Symantec Messaging Gateway 9.5.3-3 is the latest version, of their Email Security Appliance

III. DESCRIPTION

The "admin" SSH account has a restricted shell, and the password is set by the administrator during setup.

However, there is another SSH account "support" which has a default password, which is not changed during installation, and does not seem to be mentioned in the Symantec documentation as far as I can see (Installation Guide, Administration Guide or Command-line Guide). This account has a very easy-to-guess password, but many administrators may not know it exists.

Additionally, the Linux Kernel on the appliance has not been updated since late 2007 (almost 5 years) so suffers from multiple privilege escalation issues (as do other old packages on the operating system) so if SSH is accessible to an attacker, it is possible for them to login and escalate to root.

=================
Technical Details

IV. PROOF OF CONCEPT

Both the install wizard and the documentation prompt the administrator to change the password for the "admin" account, for both the UI and for SSH to the operating system. This admin account can SSH in to the appliance, with the new chosen password, and has a restricted shell environment where only certain application administration commands are possible.

It is not possible to login as root. However, there is another account "support" which has a default password of "symantec" which is not mentioned anywhere in the installer or documentation (as far as I can see) and the password is not changed as part of the installation process. This account is able to login to the OS via SSH, and does not have a restricted shell environment.

Additionally, the Linux Kernel is very old (2007) so suffers from multiple privilege escalation issues.

[+] Results for kernel version 2.6.18-274.3.1.2.el5_sms

Potential exploits:

===============
Fix Information

An updated version of the software has been released to address the vulnerability:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=2012&amp;suid=20120827_00

NCC Group Research
http://www.nccgroup.com/research

For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br>
This email message has been delivered safely and archived online by Mimecast.
</a>