PT-2012-5346 · Symantec · Symantec Messaging Gateway

Published 2012-12-05 · Updated 2013-10-11 · CVE-2012-4347

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symantec Messaging Gateway versions 9.5.x

Description The issue concerns directory traversal vulnerabilities in the management console. These vulnerabilities allow remote authenticated users to read arbitrary files. This can be achieved by including a .. (dot dot) in specific parameters, such as the logFile parameter in a logs action to "brightmail/export" or the localBackupFileSelection parameter in an APPLIANCE restoreSource action to "brightmail/admin/restore/download.do".

Recommendations For Symantec Messaging Gateway versions 9.5.x, consider restricting access to the management console and limiting the ability to perform logs actions or APPLIANCE restoreSource actions until a fix is available. As a temporary workaround, avoid using the logFile and localBackupFileSelection parameters in the affected API endpoints.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-4347

Affected Products

Symantec Messaging Gateway

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/symantec_brightmail_logfile.rb · Exploit
• 🔥 http://securityfocus.com/bid/56789 · Exploit
• 🔥 https://exploit-db.com/exploits/23110 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4347 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00 · Note