PT-2011-2433 · Symantec · Symantec Liveupdate Administrator

Lofi · Publicado 2011-03-28 · Atualizado 2018-10-09 · CVE-2011-0545

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec LiveUpdate Administrator versions prior to 2.3

Description A cross-site request forgery issue affects the adduser.do endpoint, allowing remote attackers to hijack administrator authentication for creating new administrative accounts, potentially having other unspecified impacts. The userRole parameter is involved in this issue.

Recommendations For versions prior to 2.3, update to version 2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the adduser.do endpoint to minimize the risk of exploitation. Avoid using the userRole parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2011-0545

Produtos afetados

Symantec Liveupdate Administrator

Referências · 12

• 🔥 http://sotiriu.de/adv/NSOADV-2011-001.txt · Exploit
• 🔥 http://exploit-db.com/exploits/17026 · Exploit
• 🔥 http://securitytracker.com/id?1025242 · Exploit
• 🔥 https://exploit-db.com/exploits/17026 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66213 · Nota
• http://securityfocus.com/archive/1/517109/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0545 · Nota de Segurança
• http://vupen.com/english/advisories/2011/0727 · Aviso do Fabricante
• http://osvdb.org/71261 · Nota
• http://securityreason.com/securityalert/8160 · Nota
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00 · Nota
• http://secunia.com/advisories/43820 · Aviso do Fabricante