[CVE-2013-5675] Symantec Endpoint Protection un-installation password bypass

[Aaron Lewis <the.warl0ck.1989 () gmail com>]

Hi list,

Description:
---------------------------------------------
A weakness has been revealed on SEP installation that allows user to
uninstall this product without previous knowledge of the
un-installation password.

Affected version:  12.1.2015.2015
Affected OS:       Windows XP

Details:
---------------------------------------------
The MSI module would first try to retrieve password from registry, which is:
HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\SMC\\SmcInstData

If the operation succeeds, SEP would inquiry about the un-installation password.
However, the operation may fail under two circumstances,

1) the key doesn't exist
2) the process doesn't have the permission to read the key

On Windows XP, the registry hook implementation of Symantec Endpoint
Protection was incomplete. Albeit it forbids you from removing the SMC
keys, but alternating the permission on SMC keys still works.

In order to bypass the mechanism, the end user need to revoke all read
permission on SMC keys manually, which is:
HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\SMC

P.S: Administrator privilege is still required to remove this product!
P.P.S: Legal acknowledgement: This vulnerability has already been
reported this to Symantec Threat Response team, which is ignored.

-- 
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/