[NT] McAfee Network Associates ePolicy Orchestrator Agent Privilege Escalation

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

McAfee Network Associates ePolicy Orchestrator Agent Privilege Escalation
------------------------------------------------------------------------

SUMMARY

"McAfee Security ePolicy Orchestrator is an enterprise antivirus
management tool. ePolicy Orchestrator is a policy driven deployment and
reporting tool for enterprise administrators to effectively manage their
desktop and server antivirus products."

ePolicy Orchestrator Agent allows users to obtain files of other users
without using the file permission.

DETAILS

Vulnerable Systems:
* Network Associates ePolicy Orchestrator Agent version 3.5.0 (patch 3)

The ePolicy Orchestrator Agent web server (which runs on TCP port 8081 by
default and serves the McAfee Agent Activity Log) can be used to view
files that exist on the same partition with LocalSystem level privileges.

On a default windows installation the "C:\Documents and Settings\All
Users\Application Data\Network Associates\Common Framework\Db" folder
(which is created by the EPO agent and is the folder that serves as the
web root for the McAfee Agent Activity Log) includes the NTFS permission
Everyone/Full Control.

By using the Junction tool (from SysInternals) available at
<http://www.sysinternals.com/utilities/junction.html>
http://www.sysinternals.com/utilities/junction.html one can create a sub
folder in the EPO agent web root directory (as any user) that will allow
any file on the same partition to be viewed with LocalSystem level
privileges.

Example:
1. Logon to a machine running the EPO agent as any user.
2. Using the Junction tool type the following command:
junction "C:\Documents and Settings\All Users\Application Data\Network
Associates\Common Framework\Db\Test" C:This creates the equivalent of a virtual folder in the web server root
named Test that points to C:\

3. Use Internet Explorer to view a restricted file such as:
http://127.0.0.1:8081/Test/WINDOWS/repair/sam

The contents of the restricted file will be displayed thanks to the
LocalSystem account.

ADDITIONAL INFORMATION

The information has been provided by <mailto:reedarvin@gmail.com> Reed
Arvin.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.