Re: SEP(Symantec) Bug
Symantec has reviewed the issue that was reported with smc.exe crashing from the command line. We have confirmed that an improperly formatted command line can cause the user mode process to crash. However, the privileged service process is unaffected. The client machine maintained full protection. Symantec will supply an update to prevent the command line tool from crashing in a future release.
Re: RE: SEP(Symantec) Bug
For what is is worth... I'm running MR4 version (11.0.4000.2295) and executing the command under a non-privileged account does throw a dialog box with the error message. It also puts an event in the application event log to the effect of Faulting application smc.exe, version 11.0.4000.2261, faulting module msvcr80.dll, version 8.0.50727.1433, fault address 0x79f, but watchng task manager SMC.EXE running under the SYSTEM user and SMCGUI.EXE running under the same non-privileged account never dies. I do see an additional SMC.EXE process startup under the non-privileged user, but it is the process failing. I also tried this running the command with an admin account with the same results.
Re: SEP(Symantec) Bug
Hey Jon, I am sorry about the space after the ~, That was a typo. Its been tested it on all the versions prior to MR4MP1 since the RTM(11.0.776) But what's interesting is that the process isn't crashing. But a possible arbitrary execution of code. I will do some more research into it to come up with an exploit with it. Thank you. Regards, Sandeep .-- From: Jon Kloske j...@uq.edu.au Sent: Friday, February 13, 2009 9:11 AM To: Sandeep Cheema 51l...@live.in Cc: bugtraq@securityfocus.com Subject: RE: SEP(Symantec) Bug Hi Sandeep, Are you saying this is supposed to affect 11.0.4000.x? If so, what sub-sub-minor versions did you test it on? I just tested this on 11.0.4000.2295 (on a managed client) and all it did was crash the smc.exe process started by the command you supplied, not smcgui.exe process. I tested as an administrator and an unprivileged user and got the same results - smc.exe crashes, but not the smcgui.exe process. It would be interesting if you could provide more information, since if this is actually doing what you say it's doing it would be a horrifying attack vector for worms and viruses. As an aside, I noticed that if I run smc.exe -p it crashes too, with or without the tilde (~) on the end. If I run smc -p (omit the .exe) it doesn't crash, but smc -p ~ crashes. (qualifying note: in all these cases this is just the smc.exe process that was started by the command that crashed, not the smcgui.exe process.) And yes, I tried adding the space after the tilde as you originally quoted in the email :) Regards, Jon. ps: A list of smc.exe command line parameters is available here: http://service1.symantec.com/SUPPORT/ent-security.nsf/904c88a5602c2de388 2573410063493c/d02aafed7241b975802573aa0037fb30?OpenDocument -- _ Jon Kloske [ITIG] Systems Programming Manager j...@uq.edu.au :: x54193 :: 78-516B Faculty of EAIT, UQ :: CRICOS No. 00025B -Original Message- From: Sandeep Cheema [mailto:51l...@live.in] Sent: Friday, 13 February 2009 12:16 AM To: bugtraq@securityfocus.com Subject: SEP(Symantec) Bug Hi, There is a bug with the Symantec Endpoint Protection( Tested on all versions till 11.0.4000) When you execute the following command smc.exe -p ~ the smcgui.exe crashes. You don't need admin privilege for this. Regards, Sandeep 51l3n7[at]live.in
RE: SEP(Symantec) Bug
Hi Sandeep, Are you saying this is supposed to affect 11.0.4000.x? If so, what sub-sub-minor versions did you test it on? I just tested this on 11.0.4000.2295 (on a managed client) and all it did was crash the smc.exe process started by the command you supplied, not smcgui.exe process. I tested as an administrator and an unprivileged user and got the same results - smc.exe crashes, but not the smcgui.exe process. It would be interesting if you could provide more information, since if this is actually doing what you say it's doing it would be a horrifying attack vector for worms and viruses. As an aside, I noticed that if I run smc.exe -p it crashes too, with or without the tilde (~) on the end. If I run smc -p (omit the .exe) it doesn't crash, but smc -p ~ crashes. (qualifying note: in all these cases this is just the smc.exe process that was started by the command that crashed, not the smcgui.exe process.) And yes, I tried adding the space after the tilde as you originally quoted in the email :) Regards, Jon. ps: A list of smc.exe command line parameters is available here: http://service1.symantec.com/SUPPORT/ent-security.nsf/904c88a5602c2de388 2573410063493c/d02aafed7241b975802573aa0037fb30?OpenDocument -- _ Jon Kloske [ITIG] Systems Programming Manager j...@uq.edu.au :: x54193 :: 78-516B Faculty of EAIT, UQ :: CRICOS No. 00025B -Original Message- From: Sandeep Cheema [mailto:51l...@live.in] Sent: Friday, 13 February 2009 12:16 AM To: bugtraq@securityfocus.com Subject: SEP(Symantec) Bug Hi, There is a bug with the Symantec Endpoint Protection( Tested on all versions till 11.0.4000) When you execute the following command smc.exe -p ~ the smcgui.exe crashes. You don't need admin privilege for this. Regards, Sandeep 51l3n7[at]live.in
SEP(Symantec) Bug
Hi, There is a bug with the Symantec Endpoint Protection( Tested on all versions till 11.0.4000) When you execute the following command smc.exe -p ~ the smcgui.exe crashes. You don't need admin privilege for this. Regards, Sandeep 51l3n7[at]live.in
RE: SEP(Symantec) Bug
Confirmed on XP and Vista. Error message Symantec CMC Smc has stopped working or encountered a problem and needs to close Works with smc.exe -p (anything) as long as you don't pass a command after the password. -p is the password switch.
