PT-2011-1357 · Symantec · Symantec Quarantine Server+2

Publicado

2011-01-27

·

Atualizado

2017-08-17

·

CVE-2010-0111

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Symantec AntiVirus Corporate Edition versions prior to 10.1 MR10 Symantec System Center versions 10.x Symantec Quarantine Server versions 3.5 through 3.6
Description The issue allows remote attackers to execute arbitrary programs by sending a UNC share pathname to msgsys.exe, which is used directly in a CreateProcessA call. This can lead to remote code execution.
Recommendations For Symantec AntiVirus Corporate Edition versions prior to 10.1 MR10, update to version 10.1 MR10 or later. For Symantec System Center versions 10.x, consider disabling the HDNLRSVC.EXE service until a patch is available. For Symantec Quarantine Server versions 3.5 through 3.6, restrict access to the msgsys.exe component to minimize the risk of exploitation.

Exploit

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-0111
ZDI-11-029
ZDI-11-030
ZDI-11-031
ZDI-11-032

Produtos afetados

Symantec Antivirus Corporate Edition
Symantec Quarantine Server
Symantec System Center