PT-2005-3647 · Symantec · Symantec Antivirus Corporate Edition

Golovast · Published 2005-09-02 · Updated 2016-10-18 · CVE-2005-2766

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symantec AntiVirus Corporate Edition versions 9.0.1.x through 9.0.4.x

Description The issue concerns the storage of sensitive information in cleartext in the Log.Liveupdate log file when obtaining updates from an internal LiveUpdate server. This allows attackers to obtain the username and password to the internal LiveUpdate server.

Recommendations For Symantec AntiVirus Corporate Edition versions 9.0.1.x through 9.0.4.x, consider restricting access to the Log.Liveupdate log file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-2766

Affected Products

Symantec Antivirus Corporate Edition

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2005-2766 · Security Note
• http://marc.info/?l=bugtraq&m=112552401413998&w=2 · Note