Saltar a la navegación Saltar al contenido principal Ir al pie de página

Symantec Messaging Gateway SSH with backdoor user account + privilege escalation to root due to very old Kernel

Summary

Name: Symantec Messaging Gateway – SSH with backdoor user account + privilege escalation to root due to very old Kernel
Release Date: 30 November 2012
Reference: NGS00267
Discoverer: Ben Williams 
Vendor: Symantec
Vendor Reference:
Systems Affected: Symantec Messaging Gateway 9.5.3-3
Risk: High
Status: Published

TimeLine

Discovered: 18 April 2012
Released: 18 April 2012
Approved: 29 April 2012
Reported: 30 April 2012
Fixed: 27 August 2012
Published: 30 November 2012

Description

I. VULNERABILITY

Symantec Messaging Gateway 9.5.3-3 – SSH with backdoor user account + privilege escalation to root due to very old Kernel

II. BACKGROUND

Symantec Messaging Gateway 9.5.3-3 is the latest version, of their Email Security Appliance

III. DESCRIPTION

The “admin” SSH account has a restricted shell, and the password is set by the administrator during setup.

However, there is another SSH account “support” which has a default password, which is not changed during installation, and does not seem to be mentioned in the Symantec documentation as far as I can see (Installation Guide, Administration Guide or Command-line Guide). This account has a very easy-to-guess password, but many administrators may not know it exists.

Additionally, the Linux Kernel on the appliance has not been updated since late 2007 (almost 5 years) so suffers from multiple privilege escalation issues (as do other old packages on the operating system) so if SSH is accessible to an attacker, it is possible for them to login and escalate to root.

Technical Details

IV. PROOF OF CONCEPT

Both the install wizard and the documentation prompt the administrator to change the password for the “admin” account, for both the UI and for SSH to the operating system. This admin account can SSH in to the appliance, with the new chosen password, and has a restricted shell environment where only certain application administration commands are possible.

It is not possible to login as root. However, there is another account “support” which has a default password of “symantec” which is not mentioned anywhere in the installer or documentation (as far as I can see) and the password is not changed as part of the installation process. This account is able to login to the OS via SSH, and does not have a restricted shell environment.

Additionally, the Linux Kernel is very old (2007) so suffers from multiple privilege escalation issues.

[+] Results for kernel version 2.6.18-274.3.1.2.el5_sms

Potential exploits:

Fix Information

An updated version of the software has been released to address the vulnerability:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory pvid=security_advisory year=2012 suid=20120827_00