Vulnerabilities > CVE-2015-8148 - Information Exposure vulnerability in Symantec Encryption Management Server 3.3.2

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
symantec
CWE-200
nessus
NVD
Published: 2016-02-18
Updated: 2016-12-06

Summary

The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator accounts via a modified request.

Vulnerable Configurations

Part Description Count
Application
Symantec
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyMisc.
    NASL idSYMANTEC_ENCRYPTION_SERVER_SYM16-002.NASL
    descriptionThe version of Symantec Encryption Management Server running on the remote host is 3.3.2 prior to version 3.3.2 MP12. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw in the LDAP service allows a remote attacker, via a crafted LDAP request, to gather sensitive information about valid administrator accounts on the server. (CVE-2015-8148) - A denial of service exists in the LDAP service due to a failure to properly validate user-supplied input. An unauthenticated, remote attacker can exploit this, via crafted request packets, to cause corrupted memory block headers, leading to a SIGSEGV fault and resulting in a service halt. (CVE-2015-8149) - An unspecified flaw exists that is related to scheduling commands to run via existing batch files, which normally run with root privileges. A local attacker can exploit this to gain elevated privileges on the server. (CVE-2015-8150) - A command injection vulnerability exists in the web user interface due to a failure to properly sanitize certain user-supplied input fields. An authenticated, remote attacker can exploit this to run arbitrary commands with elevated privileges on the underlying operating system. (CVE-2015-8151)
    last seen2020-06-01
    modified2020-06-02
    plugin id88903
    published2016-02-23
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88903
    titleSymantec Encryption Management Server 3.3.2 < 3.3.2 MP12 Multiple Vulnerabilities (SYM16-002)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(88903);
  script_version("1.11");
  script_cvs_date("Date: 2019/11/20");

  script_cve_id(
    "CVE-2015-8148",
    "CVE-2015-8149",
    "CVE-2015-8150",
    "CVE-2015-8151"
  );
  script_bugtraq_id(
    83268,
    83269,
    83270,
    83271
  );

  script_name(english:"Symantec Encryption Management Server 3.3.2 < 3.3.2 MP12 Multiple Vulnerabilities (SYM16-002)");
  script_summary(english:"Checks the version of Symantec Encryption Management Server.");

  script_set_attribute(attribute:"synopsis", value:
"A security policy management application running on the remote host is
affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Symantec Encryption Management Server running on the
remote host is 3.3.2 prior to version 3.3.2 MP12. It is, therefore, 
affected by multiple vulnerabilities :

  - An unspecified flaw in the LDAP service allows a remote
    attacker, via a crafted LDAP request, to gather
    sensitive information about valid administrator accounts
    on the server. (CVE-2015-8148)

  - A denial of service exists in the LDAP service due to a
    failure to properly validate user-supplied input. An
    unauthenticated, remote attacker can exploit this, via
    crafted request packets, to cause corrupted memory block
    headers, leading to a SIGSEGV fault and resulting in a
    service halt. (CVE-2015-8149)

  - An unspecified flaw exists that is related to scheduling
    commands to run via existing batch files, which normally
    run with root privileges. A local attacker can exploit
    this to gain elevated privileges on the server.
    (CVE-2015-8150)

  - A command injection vulnerability exists in the web user
    interface due to a failure to properly sanitize certain
    user-supplied input fields. An authenticated, remote
    attacker can exploit this to run arbitrary commands with
    elevated privileges on the underlying operating system.
    (CVE-2015-8151)");
  # https://support.symantec.com/en_US/article.SYMSA1346.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?24f58288");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Symantec Encryption Management Server version 3.3.2 MP12 or
later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-8150");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/02/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/02/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/02/23");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:symantec:encryption_management_server");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("symantec_encryption_server_detect.nbin");
  script_require_keys("LDAP/symantec_encryption_server/detected");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

app_name = "Symantec Encryption Management Server";

get_kb_item_or_exit("LDAP/symantec_encryption_server/detected");

port = get_service(svc:"ldap", default: 389, exit_on_fail:FALSE);

version = get_kb_item_or_exit("LDAP/symantec_encryption_server/" + port + "/version");
build = get_kb_item_or_exit("LDAP/symantec_encryption_server/" + port + "/build");

# Detection plugin places "Unknown" value if it
# happens to fail when looking for build or version
# Note: Even base versions still should have
#       build information associated with them.
if (version =~ "^U|unknown$" || build =~ "^U|unknown$")
  audit(AUDIT_UNKNOWN_APP_VER, app_name);

# Complete the version by appending build number
version = version + '.' + build;

# Check for granularity in this full version number
if (version !~ "^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$")
  audit(AUDIT_VER_NOT_GRANULAR, app_name, version);

# 3.3.2 All builds
fix = "3.3.2.21436";
fix_disp = "3.3.2.21436 (3.3.2 MP12)";

if (version =~ "^3\.3\.2\." && ver_compare(ver:version, fix:fix, strict:FALSE) == -1)
{
  report =
    '\n  Installed version : ' + version +
    '\n  Fixed version     : ' + fix_disp +
    '\n';
  security_report_v4(extra:report, port:port, severity:SECURITY_WARNING);
  exit(0);
}
else audit(AUDIT_INST_VER_NOT_VULN, app_name, version);
  • NASL familyMisc.
    NASL idSYMANTEC_ENCRYPTION_SERVER_CVE-2015-8148.NASL
    descriptionThe Symantec Encryption Management Server running on the remote host is affected by an information disclosure vulnerability when handling LDAP requests. An unauthenticated, remote attacker can exploit this, via a crafted request, to obtain sensitive information about administrator accounts.
    last seen2020-06-01
    modified2020-06-02
    plugin id89871
    published2016-03-11
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89871
    titleSymantec Encryption Management Server Remote Administrator Enumeration
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(89871);
  script_version("1.10");
  script_cvs_date("Date: 2019/11/20");

  script_cve_id("CVE-2015-8148");
  script_bugtraq_id(83271);

  script_name(english:"Symantec Encryption Management Server Remote Administrator Enumeration");
  script_summary(english:"Retrieves a list of administrator usernames via LDAP.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an information disclosure
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Symantec Encryption Management Server running on the remote host
is affected by an information disclosure vulnerability when handling
LDAP requests. An unauthenticated, remote attacker can exploit this,
via a crafted request, to obtain sensitive information about
administrator accounts.");
  # https://support.symantec.com/en_US/article.SYMSA1346.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?24f58288");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Symantec Encryption Management Server version 3.3.2 MP12");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-8148");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/02/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/02/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/11");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:symantec:encryption_management_server");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("symantec_encryption_server_detect.nbin");
  script_require_keys("LDAP/symantec_encryption_server/detected");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("kerberos_func.inc");
include("ldap_func.inc");

appname = "Symantec Encryption Management Server";
get_kb_item_or_exit("LDAP/symantec_encryption_server/detected");
port = get_service(svc:"ldap", default:389, exit_on_fail:TRUE);
version = get_kb_item_or_exit("LDAP/symantec_encryption_server/" + port + "/version");

# connect to the LDAP server
soc = open_sock_tcp(port);
if (!soc) audit(AUDIT_SOCK_FAIL, port);

# Query for all entries under pref where "surname" is present
ldap_init(socket:soc);
search = ldap_search_request(object:'o=Prefs', filter:'sn', scope:2);

# loop over the entries we got in response
adminlist = NULL;
for (ret = ldap_request_sendrecv(data:search);
     !isnull(ret) && ret[0] == LDAP_SEARCH_RES_ENTRY;
     ret = ldap_recv_next())
{
  item = eregmatch(pattern:"cn=(.+),o=prefs", string: ret[1]);
  if (!isnull(item)) adminlist += '   |  ' + item[1] + '\n'; 
}

if (!isnull(adminlist))
{
  report = '[+] List of administrator usernames:\n' + adminlist;
  security_report_v4(port:port, severity:SECURITY_WARNING, extra:report);
}
else
{
  if (version == "Unknown") audit(AUDIT_INST_VER_NOT_VULN, appname);
  build = get_kb_item("LDAP/symantec_encryption_server/" + port + "/build");
  if (isnull(build) || build == "Unknown") audit(AUDIT_INST_VER_NOT_VULN, appname, version);
  audit(AUDIT_INST_VER_NOT_VULN, appname, version, build);
}

References