PT-2012-2480 · Symantec · Symantec Liveupdate Administrator

Published 2012-06-22 · Updated 2013-04-02 · CVE-2012-0304

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec LiveUpdate Administrator versions prior to 2.3.1

Description The issue is related to weak permissions set for the installation directory, allowing local users to gain privileges. This can be achieved by creating a Trojan horse file.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-0304

Affected Products

Symantec Liveupdate Administrator

References · 5

• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120615_00 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0304 · Security Note
• http://securityfocus.com/bid/53903 · Note
• http://nessus.org/plugins/index.php?view=single&id=59193 · Note
• http://securitytracker.com/id?1027182 · Note