PT-2012-2475 · Symantec · Symantec Web Gateway

Published 2012-05-21 · Updated 2017-12-05 · CVE-2012-0299

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions 5.0.x through 5.0.2

Description The issue allows remote attackers to upload arbitrary code to a designated pathname and possibly execute this code via unspecified vectors. This is related to the file-management scripts in the management GUI.

Recommendations For Symantec Web Gateway versions 5.0.x through 5.0.2, update to version 5.0.3 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-0299

ZDI-12-091

Affected Products

Symantec Web Gateway

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb · Exploit
• 🔥 https://exploit-db.com/exploits/19038 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-0299 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-12-091 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00 · Vendor Advisory
• http://securityfocus.com/bid/53443 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75730 · Note