PT-2004-1382 · Symantec+1 · Symantec Antivirus Scan Engine+1

Published 2004-03-16 · Updated 2024-01-26 · CVE-2004-0217

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec AntiVirus Scan Engine versions 4.0 through 4.3

Description The issue allows local users to create or append to arbitrary files via a symlink attack on /tmp/LiveUpdate.log. This is related to the LiveUpdate capability (liveupdate.sh) in Symantec AntiVirus Scan Engine for Red Hat Linux.

Recommendations For Symantec AntiVirus Scan Engine versions 4.0 through 4.3, consider restricting access to the liveupdate.sh script until a fix is available. As a temporary workaround, avoid using the LiveUpdate capability to minimize the risk of exploitation. Restrict write access to the /tmp/LiveUpdate.log file to prevent arbitrary file creation or appending.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2004-0217

Affected Products

Red Hat

Symantec Antivirus Scan Engine

References · 5

• 🔥 http://marc.info/?l=bugtraq&m=107694800908164&w=2 · Exploit
• http://securityfocus.com/bid/9662 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0217 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15215 · Note
• https://t.me/cvenotify/68887 · Telegram Post