PT-2015-3922 · Symantec · Encryption Management Server+1

Publicado 2015-02-01 · Atualizado 2017-09-08 · CVE-2014-7287

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symantec PGP Universal Server and Encryption Management Server versions prior to 3.3.2 MP7

Description The issue allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message. This can be demonstrated by the outbound Subject header.

Recommendations For versions prior to 3.3.2 MP7, update to version 3.3.2 MP7 or later to resolve the issue.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2014-7287

Produtos afetados

Encryption Management Server

Symantec Pgp Universal Server

Referências · 5

• http://securityfocus.com/bid/72307 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-7287 · Nota de Segurança
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150129_00 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100762 · Nota
• http://securitytracker.com/id/1031673 · Nota