PT-2006-3976 · Symantec · Symantec Security Information Manager

Publicado 2006-06-19 · Atualizado 2017-07-20 · CVE-2006-3072

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Security Information Manager versions prior to 4.0.2.29 HOTFIX 1

Description The issue allows local users to execute arbitrary commands by crafting "rule definitions" that produce dangerous Java code during M4 transformation.

Recommendations For versions prior to 4.0.2.29 HOTFIX 1, update to version 4.0.2.29 HOTFIX 1 to resolve the issue. As a temporary workaround, consider restricting access to the M4 Macro Library to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-3072

Produtos afetados

Symantec Security Information Manager

Referências · 7

• http://securityresponse.symantec.com/avcenter/security/Content/2006.06.13b.html · Nota
• http://securitytracker.com/id?1016296 · Correção
• http://secunia.com/advisories/20647 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/2334 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27105 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3072 · Nota de Segurança
• http://securityfocus.com/bid/18420 · Nota