PT-2011-1357 · Symantec · Symantec Quarantine Server+2

Published 2011-01-27 · Updated 2017-08-17 · CVE-2010-0111

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec AntiVirus Corporate Edition versions prior to 10.1 MR10 Symantec System Center versions 10.x Symantec Quarantine Server versions 3.5 through 3.6

Description The issue allows remote attackers to execute arbitrary programs by sending a UNC share pathname to msgsys.exe, which is used directly in a CreateProcessA call. This can lead to remote code execution.

Recommendations For Symantec AntiVirus Corporate Edition versions prior to 10.1 MR10, update to version 10.1 MR10 or later. For Symantec System Center versions 10.x, consider disabling the HDNLRSVC.EXE service until a patch is available. For Symantec Quarantine Server versions 3.5 through 3.6, restrict access to the msgsys.exe component to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-0111

ZDI-11-029

ZDI-11-030

ZDI-11-031

ZDI-11-032

Affected Products

Symantec Antivirus Corporate Edition

Symantec Quarantine Server

Symantec System Center

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/antivirus/ams_hndlrsvc.rb · Exploit
• http://secunia.com/advisories/43106 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-11-031 · Security Note
• http://secunia.com/advisories/43099 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-11-030 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-11-032 · Security Note
• http://vupen.com/english/advisories/2011/0234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0111 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-11-029 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_01 · Note
• http://securityfocus.com/bid/45935 · Note
• http://zerodayinitiative.com/advisories/ZDI-11-029 · Note
• http://xforce.iss.net/xforce/xfdb/64943 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64942 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64943 · Note