PT-2005-3647 · Symantec · Symantec Antivirus Corporate Edition

Golovast · Publicado 2005-09-02 · Atualizado 2016-10-18 · CVE-2005-2766

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symantec AntiVirus Corporate Edition versions 9.0.1.x through 9.0.4.x

Description The issue concerns the storage of sensitive information in cleartext in the Log.Liveupdate log file when obtaining updates from an internal LiveUpdate server. This allows attackers to obtain the username and password to the internal LiveUpdate server.

Recommendations For Symantec AntiVirus Corporate Edition versions 9.0.1.x through 9.0.4.x, consider restricting access to the Log.Liveupdate log file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-2766

Produtos afetados

Symantec Antivirus Corporate Edition

Referências · 2

• http://marc.info/?l=bugtraq&m=112552401413998&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2766 · Nota de Segurança