PT-2015-7036 · Symantec · Symantec Deployment Solution+1

Steven Seeley · Publicado 2015-09-03 · Atualizado 2016-12-22 · CVE-2015-5689

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Ghost Solutions Suite (GSS) versions prior to 3.0 HF2 12.0.0.8010 Symantec Deployment Solution (DS) versions prior to 7.6 HF4 12.0.0.7045

Description The issue is related to improper sign-extend operations before array-element accesses in the ghostexp.exe component of Symantec Ghost Solutions Suite (GSS) and Symantec Deployment Solution (DS). This allows remote attackers to execute arbitrary code, cause a denial of service (application crash), or possibly obtain sensitive information via a crafted Ghost image.

Recommendations For Symantec Ghost Solutions Suite (GSS) versions prior to 3.0 HF2 12.0.0.8010, update to version 3.0 HF2 12.0.0.8010 or later. For Symantec Deployment Solution (DS) versions prior to 7.6 HF4 12.0.0.7045, update to version 7.6 HF4 12.0.0.7045 or later.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-5689

ZDI-15-419

Produtos afetados

Symantec Deployment Solution

Symantec Ghost Solution Suite

Referências · 6

• http://securitytracker.com/id/1033577 · Nota
• http://zerodayinitiative.com/advisories/ZDI-15-419 · Nota
• https://zerodayinitiative.com/advisories/ZDI-15-419 · Nota de Segurança
• http://securityfocus.com/bid/76498 · Nota
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150902_00 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5689 · Nota de Segurança