PT-2012-2479 · Symantec · Symantec Message Filter+1

Published 2012-07-05 · Updated 2012-07-06 · CVE-2012-0303

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Message Filter version 6.3

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the Brightmail Control Center component. These vulnerabilities allow remote attackers to hijack the authentication of arbitrary users, enabling them to execute application commands or create admin accounts.

Recommendations For Symantec Message Filter version 6.3, consider disabling access to the Brightmail Control Center until a patch is available to prevent potential exploitation of the CSRF vulnerabilities. Restrict access to admin account creation and application command execution to minimize the risk of unauthorized actions.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-0303

Affected Products

Brightmail Control Center

Symantec Message Filter

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-0303 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120626_00 · Vendor Advisory
• http://securityfocus.com/bid/54133 · Note