PT-2018-11073 · Symantec · Symantec Endpoint Protection

Publicado 2018-11-29 · Atualizado 2018-12-28 · CVE-2018-12245

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions prior to 14.2 MP1

Description The issue is related to a DLL Preloading vulnerability, which occurs when an application unintentionally loads a DLL provided by a potential attacker during installation. This exploit only manifests at install time and does not affect already installed software. The problem was specific to the Trialware media for Symantec Endpoint Protection.

Recommendations For Symantec Endpoint Protection versions prior to 14.2 MP1, update to version 14.2 MP1 or later to resolve the issue.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2018-12245

Produtos afetados

Symantec Endpoint Protection

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-12245 · Aviso do Fabricante
• http://securityfocus.com/bid/105919 · Nota
• https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1468.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12245 · Nota de Segurança