Rapid7, LLC Security Advisory
Rapid7 Advisory R7-0021
Symantec Scan Engine Authentication Fundamental Design Error
Published: April 21, 2006
1. Affected system(s):
o Symantec Scan Engine v18.104.22.168
o Symantec Scan Engine v22.214.171.124
UNKNOWN (PROBABLY VULNERABLE):
o All v5.0.x.x
o Earlier versions
Symantec Scan Engine provides a web-based administrative interface
that is used for managing scanning options and antivirus
definitions. To access the interface, an administrator must browse
to it, load a Java applet, and log in with a password.
However, the authentication mechanism used by Symantec Scan Engine
contains a fundamental design flaw that allows any remote user to
gain full administrative access to the server. The server does not
verify the password entered by the user. The password is only
verified by the client-side Java applet. Anyone with knowledge of
the underlying communication mechanism can exercise full control of
the Scan Engine server simply by posting XML requests to the server
using its proprietary protocol.
NeXpose, Rapid7's award-winning vulnerability assessment platform,
checks for this vulnerability and other vulnerabilities we have
discovered in Symantec Scan Engine. Visit http://www.rapid7.com
to register for a free demo of NeXpose.
3. Vendor status and information
Symantec was notified of this vulnerability on January 17, 2006.
They acknowledged the vulnerability, then provided us with a
fixed version. Rapid7's advisory was publicly released on April 21,
Upgrade to Symantec Scan Engine v126.96.36.199 or later.
5. Detailed analysis
The administrative web interface, which is typically accessible on
default TCP port 8004, is implemented as a Java applet. Also, an
additional SSL connection to TCP port 8005 is used by the applet to
exchange configuration information with the server using a proprietary
protocol based on XML exchanges. The authentication model used by the
administrative interface is utterly flawed, because the server trusts
the client applet to correctly authenticate users. The protocols
themselves (HTTP on port 8004 and proprietary protocol on port 8005)
do NOT require client authentication.
For example, when an administrator user changes his password via the
administrative interface, the Java applet simply connects to port
8005 and sends a request to change the administrator password hash.
No authentication is required. The direct consequence of this is
that any remote attacker can change the administrator password to a
password of his choice.
We have included with this advisory a proof-of-concept Perl script
which demonstrates this vulnerability
Here is an example scenario:
$ ./change_scan_engine_pw.pl --pwd foobar 10.68.4.4
Password successfully set to: 'foobar'
$ ./change_scan_engine_pw.pl \
The first command resets the administrator password to 'foobar': it
asks Scan Engine for the current administrator password hash
(E97B...) for information purpose only (the attack does not actually
require knowledge of the previous password hash), computes the hash
corresponding to the new password (6562...), and uploads this new
hash. The second command just restores the previous password (which
is unknown) by re-uploading the previous hash (E97B...) to the
Note: the 256-bit password hash is computed using the following
algorithm. First, a random 128-bit salt is chosen. Second, a character
string is built by concatenating the password string and the
uppercase hexadecimal representation of the salt. Third, the 128-bit
MD5 digest of this concatenated string is computed. Finally the
256-bit password hash is built by concatenating the 128-bit MD5
digest and the 128-bit salt.
This vulnerability was discovered by Marc Bevand of Rapid7.
7. Contact Information
Phone: +1 (617) 247-1717
8. Disclaimer and Copyright
Rapid7, LLC is not responsible for the misuse of the information
provided in our security advisories. These advisories are a service
to the professional security community. There are NO WARRANTIES with
regard to this information. Any application or distribution of this
information constitutes acceptance AS IS, at the user's own risk.
This information is subject to change without notice.
This advisory Copyright (C) 2006 Rapid7, LLC. Permission is hereby
granted to redistribute this advisory, providing that no changes are
made and that the copyright notices and disclaimers remain intact.
The proof of concept script follows:
# Remotely change the administrator password (or password hash) of
# Symantec Scan Engine.
# Author: Marc Bevand of Rapid7