====================================================================

                                         CERT-Renater

                             Note d'Information No. 2015/VULN167
_____________________________________________________________________

DATE                : 04/09/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running F-Secure Gatekeeper driver.

======================================================================
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2015&suid=20150902_00
______________________________________________________________________

security advisories

FSC-2015-3: Local Privilege Escalation

Description

An Access Control List (ACL) bypass in the F-Secure Gatekeeper driver 
Symantec
allows local privilege escalation through kernel memory corruption.


Affected Products

Risk Level: HIGH (Low/Medium/High/Critical)


Component

      F-Secure Gatekeeper driver - FSGK.SYS

Corporate products

      F-Secure Client Security

      F-Secure Client Security Premium

      F-Secure Anti-Virus for Workstations

      F-Secure Server Security

      F-Secure Server Security Premium

      F-Secure Email and Server Security

      F-Secure Email and Server Security Premium

      F-Secure Protection Service for Business (PSB) Workstation Security

      F-Secure Protection Service for Business (PSB) Server Security

      F-Secure Protection Service for Business (PSB) Email and Server
       Security

Consumer products

      F-Secure Safe Anywhere PC F-Secure Internet Security F-Secure 
Anti-Virus


Platforms

Risk Level: HIGH (Low/Medium/High/Critical)

      Windows


More Information

It was discovered that it is possible to bypass the Access Control List
(ACL) for the F-Secure Gatekeeper device driver, even when access
rights is given only to an Administrator or SYSTEM account. This is
caused by the missing flag of FILE_DEVICE_SECURE_OPEN when creating an
object. A successful bypass of the ACL will allow an attacker to
manipulate the kernel buffer allocation, resulting in a memory
corruption. Successful exploitation will result in a local privilege
escalation of a normal user account to an administrator or
system account.


Fix Available

Component	Versions 	Remarks

fsgk.sys 	10.80.110.65	Fix is available in the automatic
                                  update channel
				for all affected products. No user
                                  action is
				needed if automatic updates is enabled.


Credits

F-Secure Corporation would like to thank Ilja van Sprundel from IOActive 
and Thierry Decroix for bringing this issue to our attention.

Date Issued: 2015-09-01

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================