PT-2009-3935 · Symantec · Symantec Reporting Server+6
Publicado
2009-04-30
·
Atualizado
2019-07-26
·
CVE-2009-1432
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Symantec Reporting Server versions prior to 10.1 MR8
Symantec AntiVirus (SAV) Corporate Edition versions prior to 10.1 MR8
Symantec AntiVirus (SAV) Corporate Edition versions prior to 10.2 MR2
Symantec Client Security (SCS) versions prior to 3.1 MR8
Symantec Endpoint Protection Manager (SEPM) component in Symantec Endpoint Protection (SEP) versions prior to 11.0 MR2
Description
The issue allows remote attackers to inject arbitrary text into the login screen, and possibly conduct phishing attacks, via vectors involving a URL that is not properly handled.
Recommendations
For Symantec Reporting Server versions prior to 10.1 MR8, update to version 10.1 MR8 or later.
For Symantec AntiVirus (SAV) Corporate Edition versions prior to 10.1 MR8, update to version 10.1 MR8 or later.
For Symantec AntiVirus (SAV) Corporate Edition versions prior to 10.2 MR2, update to version 10.2 MR2 or later.
For Symantec Client Security (SCS) versions prior to 3.1 MR8, update to version 3.1 MR8 or later.
For Symantec Endpoint Protection Manager (SEPM) component in Symantec Endpoint Protection (SEP) versions prior to 11.0 MR2, update to version 11.0 MR2 or later.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Symantec Antivirus
Symantec Antivirus Corporate Edition
Symantec Client Security
Symantec Endpoint Protection
Symantec Endpoint Protection Client
Symantec Endpoint Protection Manager
Symantec Reporting Server