PT-2015-3922 · Symantec · Encryption Management Server+1

Published 2015-02-01 · Updated 2017-09-08 · CVE-2014-7287

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symantec PGP Universal Server and Encryption Management Server versions prior to 3.3.2 MP7

Description The issue allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message. This can be demonstrated by the outbound Subject header.

Recommendations For versions prior to 3.3.2 MP7, update to version 3.3.2 MP7 or later to resolve the issue.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2014-7287

Affected Products

Encryption Management Server

Symantec Pgp Universal Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-7287 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150129_00 · Vendor Advisory
• http://securityfocus.com/bid/72307 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100762 · Note
• http://securitytracker.com/id/1031673 · Note