PT-2007-4315 · Symantec · Symantec Antivirus Corporate Edition+2

Published 2007-06-05 · Updated 2017-07-29 · CVE-2007-3022

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Symantec Reporting Server versions 1.0.197.0 through 1.0.223.0 Symantec Client Security versions 3.1 and later (affected versions not specified) Symantec AntiVirus Corporate Edition (SAV CE) versions 10.1 and later (affected versions not specified)

Description: The issue allows remote attackers to more easily conduct brute force attacks due to the display of a user's password hash after a failed login attempt.

Recommendations: For Symantec Reporting Server versions 1.0.197.0 through 1.0.223.0, update to version 1.0.224.0 or later. For Symantec Client Security and Symantec AntiVirus Corporate Edition, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-3022

Affected Products

Symantec Antivirus Corporate Edition

Symantec Client Security

Symantec Reporting Server

References · 9

• http://symantec.com/avcenter/security/Content/2007.06.05.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-3022 · Security Note
• http://securityfocus.com/bid/24312 · Note
• http://vupen.com/english/advisories/2007/2074 · Note
• http://securitytracker.com/id?1018196 · Note
• http://secunia.com/advisories/25543 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34740 · Note
• http://osvdb.org/36108 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3022 · Note