[NT] McAfee Network Associates ePolicy Orchestrator Agent Privilege Escalation

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  McAfee Network Associates ePolicy Orchestrator Agent Privilege Escalation
------------------------------------------------------------------------


SUMMARY

"McAfee Security ePolicy Orchestrator is an enterprise antivirus 
management tool. ePolicy Orchestrator is a policy driven deployment and 
reporting tool for enterprise administrators to effectively manage their 
desktop and server antivirus products."

ePolicy Orchestrator Agent allows users to obtain files of other users 
without using the file permission.

DETAILS

Vulnerable Systems:
 * Network Associates ePolicy Orchestrator Agent version 3.5.0 (patch 3)

The ePolicy Orchestrator Agent web server (which runs on TCP port 8081 by 
default and serves the McAfee Agent Activity Log) can be used to view 
files that exist on the same partition with LocalSystem level privileges.

On a default windows installation the "C:\Documents and Settings\All 
Users\Application Data\Network Associates\Common Framework\Db" folder 
(which is created by the EPO agent and is the folder that serves as the 
web root for the McAfee Agent Activity Log) includes the NTFS permission 
Everyone/Full Control.

By using the Junction tool (from SysInternals) available at  
<http://www.sysinternals.com/utilities/junction.html> 
http://www.sysinternals.com/utilities/junction.html one can create a sub 
folder in the EPO agent web root directory (as any user) that will allow 
any file on the same partition to be viewed with LocalSystem level 
privileges.

Example:
 1. Logon to a machine running the EPO agent as any user.
 2. Using the Junction tool type the following command:
   junction "C:\Documents and Settings\All Users\Application Data\Network 
Associates\Common Framework\Db\Test" C:\
This creates the equivalent of a virtual folder in the web server root 
named Test that points to C:\

 3. Use Internet Explorer to view a restricted file such as:
   http://127.0.0.1:8081/Test/WINDOWS/repair/sam

   The contents of the restricted file will be displayed thanks to the 
LocalSystem account.


ADDITIONAL INFORMATION

The information has been provided by  <mailto:reedarvin@xxxxxxxxx> Reed 
Arvin.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.