PT-2015-4164 · Symantec · Symantec Data Center Security: Server Advanced+1

Published 2015-01-21 · Updated 2021-08-04 · CVE-2014-9225

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symantec Critical System Protection (SCSP) versions 5.2.9 through 5.2.9 MP6 Symantec Data Center Security: Server Advanced (SDCS:SA) versions 6.0.x through 6.0 MP1

Description The issue allows remote authenticated users to obtain sensitive server information.

Recommendations For Symantec Critical System Protection (SCSP) versions 5.2.9 through 5.2.9 MP6, update to a version outside of the affected range. For Symantec Data Center Security: Server Advanced (SDCS:SA) versions 6.0.x through 6.0 MP1, update to a version outside of the affected range.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-9225

Affected Products

Symantec Critical System Protection

Symantec Data Center Security: Server Advanced

References · 7

• 🔥 https://exploit-db.com/exploits/35915 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9225 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150119_00 · Vendor Advisory
• http://seclists.org/fulldisclosure/2015/Jan/91 · Note
• http://securityfocus.com/archive/1/534527/100/0/threaded · Note
• http://packetstormsecurity.com/files/130060/Symantec-SDCS-SA-SCSP-XSS-Bypass-SQL-Injection-Disclosure.html · Note
• http://securityfocus.com/bid/72094 · Note