Multiple critical vulnerabilities in Symantec LiveUpdate Administrator

SEC Consult Vulnerability Lab Security Advisory < 20140328-0 >


title: Multiple critical vulnerabilities

product: Symantec LiveUpdate Administrator

vulnerable version: <=

fixed version:

impact: critical

CVE number: CVE-2014-1644, CVE-2014-1645


found: 2014-01-02

by: Stefan Viehböck

SEC Consult Vulnerability Lab


Vendor description:


"LiveUpdate Administrator is an enterprise Web application that allows you to

manage updates on multiple internal Central Update servers, called Distribution

Centers. Using LiveUpdate Administrator, you download updates to the Manage

Updates folder, and then send the updates to production distribution servers

for Update clients to download, or to testing distribution centers, so that the

updates can be tested before they are distributed to production.



Business recommendation:


Attackers are able to compromise LiveUpdate Administrator at the

application and database levels. This enables access to credentials of update

servers on the network.

It is highly recommended by SEC Consult not to use this software until a

thorough security review has been performed by security professionals and all

identified issues have been resolved.


Vulnerability overview/description:


1) Unauthenticated arbitrary account password reset (CVE-2014-1644)

The reset password is not properly protected and allows unauthenticated

attackers to reset passwords of arbitrary users.

Using this vulnerability an attacker can gain full access to the LiveUpdate

Administrator web interface.

An attacker can use this vulnerability to retrieve usernames/passwords of

internal LiveUpdate servers and execute attacks against those servers.

2) Unauthenticated SQL injection (CVE-2014-1645)

Several SQL injection vulnerabilities were discovered in the application.

These vulnerabilities allow attackers to exfiltrate database contents

(including user names, passwords, server credentials) and possibly to

compromise the host system as well.


Proof of concept:


1) Unauthenticated arbitrary account password reset (CVE-2014-1644)

The following request shows how the password of the user with the email address

"" can be set to "11111111".

Affected script: /lua/

Detailed proof of concept exploits have been removed for this vulnerability.

2) Unauthenticated SQL injection (CVE-2014-1645)

The following request shows how the SQL injection in the password reset

functionality can be exploited (blind, timing).

Affected script: /lua/

Detailed proof of concept exploits have been removed for this vulnerability.

The password recovery functionality (/loginforgotpwd)is vulnerable to SQL

injection as well. Several DAO methods show incorrect use of prepared

statements and were not investigated further.


Vulnerable / tested versions:


The vulnerabilities have been verified to exist in Symantec LiveUpdate

Administrator version 12.1.4013, which was the most recent version at the time

of discovery.


Vendor contact timeline:


2014-01-09: Sending advisory and proof of concept exploit via encrypted


2014-01-09: Vendor acknowledges receipt of advisory.

2014-02-24: Requesting status update.

2014-02-25: Vendor confirms vulnerability.

2014-02-25: Vendor plans release in late march.

2014-03-25: Vendor provides schedule.

2014-03-27: Vendor provides CVE-IDs and releases fixed version.

2014-03-28: SEC Consult releases coordinated security advisory.




Update to the most recent version ( of Symantec LiveUpdate


More information can be found at:




No workaround available.


Advisory URL:




SEC Consult Vulnerability Lab

SEC Consult

Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius


Mooslackengasse 17, 1190 Vienna, Austria

Phone: +43 1 8903043 0

Fax: +43 1 8903043 15

Mail: research at sec-consult dot com




Interested to work with the experts of SEC Consult?

Write to

EOF Stefan Viehböck / @2014