CVE-2018-18369 in Norton Security
Summary
by MITRE
Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/02/2020
The vulnerability identified as CVE-2018-18369 represents a critical DLL preloading flaw affecting Norton Security Windows client versions prior to 22.16.3 and SEP SBE Windows client versions prior to Cloud Agent 3.00.31.2817. This vulnerability stems from improper handling of dynamic link library loading sequences within the affected security software applications. The flaw manifests when legitimate applications attempt to load required DLL components but inadvertently execute attacker-controlled malicious DLLs instead of the intended system libraries. This type of vulnerability falls under CWE-426, known as "Untrusted Search Path," which specifically addresses the risks associated with applications that do not properly validate the source and integrity of dynamically loaded libraries. The vulnerability creates a dangerous condition where an attacker positioned in the same directory as a target executable can place a malicious DLL with the same name as a legitimate library that the application expects to load.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it provides attackers with a sophisticated method to execute arbitrary code within the context of the affected security applications. When Norton Security or SEP SBE applications process certain operations that require DLL loading, they may inadvertently load malicious libraries from the current working directory rather than from the proper system paths. This creates an attack surface where adversaries can place malicious DLL files in directories accessible to the security applications, potentially gaining elevated privileges and bypassing security controls that these applications are designed to enforce. The vulnerability is particularly concerning in enterprise environments where these security tools are widely deployed and may run with elevated privileges. According to ATT&CK framework technique T1574.001, this vulnerability aligns with "DLL Preloading" tactics that exploit weaknesses in Windows DLL loading behavior, allowing attackers to execute malicious code through legitimate system processes.
Mitigation strategies for CVE-2018-18369 should prioritize immediate patching of affected versions to the latest releases specified in the vulnerability advisory. Organizations must ensure that all instances of Norton Security and SEP SBE are updated to versions 22.16.3 and Cloud Agent 3.00.31.2817 respectively, which contain the necessary fixes for proper DLL loading behavior. Additionally, system administrators should implement strict directory permissions and monitoring to prevent unauthorized DLL placement in directories where security applications operate. Network segmentation and privilege minimization should be enforced to limit the potential impact of successful exploitation attempts. The implementation of application whitelisting solutions can further protect against unauthorized DLL execution by restricting which libraries can be loaded by security applications. Security teams should also conduct regular vulnerability assessments to identify other potentially affected applications that may exhibit similar DLL preloading behaviors, as this vulnerability type remains prevalent in legacy software implementations and can be exploited across various security toolsets within enterprise environments.