PT-2017-9947 · Symantec · Symantec Endpoint Protection+1

Publicado 2017-03-06 · Atualizado 2018-05-23 · CVE-2016-9093

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions 12.1 RU6 MP6 and earlier

Description The issue is related to the SymEvent Driver's failure to properly sanitize logged-in user input. This could allow a non-admin user to potentially manipulate certain system calls by saving and running a specially constructed executable file. The impact can range from a denial of service, causing the system to crash, to allowing the user to run arbitrary code on the local machine with kernel-level privileges in very specific circumstances on 64-bit systems. This could result in a non-privileged user gaining privileged access on the local machine.

Recommendations For Symantec Endpoint Protection versions 12.1 RU6 MP6 and earlier, update to a version later than 14.0 to resolve the issue. As a temporary workaround, consider restricting access to the SymEvent Driver interface to minimize the risk of exploitation.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-9093

Produtos afetados

Symantec Endpoint Protection

Symantec Endpoint Protection Client

Referências · 5

• http://securityfocus.com/bid/96294 · Nota
• http://securitytracker.com/id/1037961 · Nota
• https://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170306_00 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-9093 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-9093 · Nota de Segurança