AD20060713
Published: 2006-07-11 00:00:00
Updated: 2006-07-11 00:00:00
McAfee ePolicy Orchestrator Remote Compromise Please Note: This vulnerability was independently discovered by McAfee and eEye Digital Security. McAfee has silently fixed this vulnerability, prior to the eEye discovery. Release Date: July 11, 2006 Severity: High (Remote Code Execution) Vendor: McAfee Systems Affected: Windows systems running McAfee ePolicy Orchestrator agent, versions 3.5.0.x and previous. Overview: McAfee ePolicy Orchestrator is the remote security management software for the McAfee enterprise product suite. EPO allows you to configure and enforce protection policies, deploy and configure agents, and monitor security status from a centralized console. eEye Digital Security has discovered a serious flaw within the Framework Service component of the McAfee EPO management console. The Framework service is enabled and running by default on all servers and agents. The framework service listens by default on port 8081 and accepts requests over the HTTP protocol. The framework service allows for remotely submitting configuration and update changes. Each request is encrypted, SHA-1 hashed and DSA signed, and written to a file on disk. Due to a directory traversal attack, it is possible to write any file with any contents to anywhere on the remote system. This flaw allows a remote attacker to anonymously compromise an affected system and execute code within the SYSTEM context. Technical Details: The framework service accepts POST requests over the /spipe/pkg interface. These POST requests contain a header which indicates the type of package request, UUID, and computer hostname. Depending on the request, the block that follows may contain data specific to that request. In the case of this vulnerability, the type of request (PackageType) is “PropsResponse”. The data that follows first specifies a directory and xml filename, and is followed by the contents of the xml file. Due to improper sanity checking on the directory and filename, it is possible to use a directory traversal attack to write a user defined filename, with user defined contents, anywhere on the system. A factor that would hinder exploitation is the fact that the file is immediately deleted after use - this problem can be overcome by increasing the file data length field to exceed the actual data length. Each package request is obfuscated by XOR'ing the package data with the static byte 0xAA, and is then SHA-1 hashed and DSA signed. The vulnerable package format follows: +00h WORD magic = "PO" (0x4F50) +02h DWORD = 20000001h, 20001001h, or 30000001 +06h DWORD file offset of XML +0Ah [E0h] fixed-length data +0Ah DWORD +0Eh DWORD +12h DWORD length of XML +16h [40h] ASCII ??? GUID +56h [40h] ASCII ??? GUID +96h DWORD +9Ah [???] ASCII host name ... +EAh [...] name-value pairs X+00h DWORD length of following name string +04h [...] ASCII name string (no null terminator) X+00h DWORD length of following value data +04h [...] value data (null terminated if ASCII string) X+00h [...] XML +00h WORD +02h WORD length of following file name string +04h [...] ASCII .xml file name string * traversal attack, may be any directory and file extension X+00h DWORD length of following XML * increase length to prevent deletion +04h [...] ASCII XML * filename data X+00h DWORD length of signature data = 2Ch +04h WORD (big-endian) number of bits in DSA signature 'r' component +06h [14h] DSA signature 'r' component (technically it's variable-length) +1Ah WORD (big-endian) number of bits in DSA signature 's' component +1Ch [14h] DSA signature 's' component (also variable-length) The package may be modified to generate any file, anywhere on the system, with any extension. Exploitation is 100% reliable due to the fact we are merely taking advantage of functions already implemented within the framework service. Protection: Retina Network Security Scanner has been updated to identify this vulnerability. Blink - Endpoint Vulnerability Prevention - preemptively protects from this vulnerability. Vendor Status: McAfee customers must login to the McAfee customer website and download version 3.5.5 or higher of the Common Management Agent (ePO Framework) and upgrade existing ePO agent deployments. This can be done through normal deployment methods through ePolicy Orchestrator. https://secure.nai.com/us/forms/downloads/upgrades/login.asp Credit: Barnaby Jack Additional Research: Derek Soeder Related Links: Retina Network Security Scanner - Free Trial Blink Endpoint Vulnerability Prevention - Free Trial Greetings: Derek (props!), D R E, Carlos, the Samyo's, MereMac, Big Smooth and the rest of the boys from R-Block. Copyright (c) 1998-2006 eEye Digital Security Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email mailto:alert@eEye.com for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.
