PT-2016-2308 · Symantec · Symantec Protection For Sharepoint Servers+18

Published 2016-06-30 · Updated 2020-05-11 · CVE-2016-3644

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Advanced Threat Protection (ATP) Symantec Data Center Security:Server (SDCS:S) versions 6.x through 6.6 MP1 Symantec Web Gateway Symantec Endpoint Protection (SEP) versions prior to 12.1 RU6 MP5 Symantec Endpoint Protection (SEP) for Mac Symantec Endpoint Protection (SEP) for Linux versions prior to 12.1 RU6 MP5 Symantec Protection Engine (SPE) versions prior to 7.0.5 HF01, versions 7.5.x prior to 7.5.3 HF03, version 7.5.4 before HF01, and version 7.8.0 before HF01 Symantec Protection for SharePoint Servers (SPSS) versions 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and version 6.0.6 before HF 1.6 Symantec Mail Security for Microsoft Exchange (SMSMSE) versions prior to 7.0 3966002 HF1.1 and versions 7.5.x prior to 7.5 3966008 VHF1.2 Symantec Mail Security for Domino (SMSDOM) versions prior to 8.0.9 HF1.1 and versions 8.1.x prior to 8.1.3 HF1.2 CSAPI versions prior to 10.0.4 HF01 Symantec Message Gateway (SMG) versions prior to 10.6.1-4 Symantec Message Gateway for Service Providers (SMG-SP) version 10.5 before patch 254 and version 10.6 before patch 253 Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 versions prior to NGC 22.7 Norton Security for Mac versions prior to 13.0.2 Norton Power Eraser (NPE) versions prior to 5.1 Norton Bootable Removal Tool (NBRT) versions prior to 2016.1

Description The AntiVirus Decomposer engine in Symantec products contains an issue that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via modified MIME data in a message. This issue is caused by an integer overflow or buffer overflow.

Recommendations For Symantec Advanced Threat Protection (ATP), update to a version that includes the fix for this issue. For Symantec Data Center Security:Server (SDCS:S) versions 6.x through 6.6 MP1, update to a version that includes the fix for this issue. For Symantec Web Gateway, update to a version that includes the fix for this issue. For Symantec Endpoint Protection (SEP) versions prior to 12.1 RU6 MP5, update to version 12.1 RU6 MP5 or later. For Symantec Endpoint Protection (SEP) for Mac, update to a version that includes the fix for this issue. For Symantec Endpoint Protection (SEP) for Linux versions prior to 12.1 RU6 MP5, update to version 12.1 RU6 MP5 or later. For Symantec Protection Engine (SPE) versions prior to 7.0.5 HF01, update to version 7.0.5 HF01 or later. For Symantec Protection Engine (SPE) versions 7.5.x prior to 7.5.3 HF03, update to version 7.5.3 HF03 or later. For Symantec Protection Engine (SPE) version 7.5.4 before HF01, update to version 7.5.4 HF01 or later. For Symantec Protection Engine (SPE) version 7.8.0 before HF01, update to version 7.8.0 HF01 or later. For Symantec Protection for SharePoint Servers (SPSS) versions 6.0.3 through 6.0.5 before 6.0.5 HF 1.5, update to version 6.0.5 HF 1.5 or later. For Symantec Protection for SharePoint Servers (SPSS) version 6.0.6 before HF 1.6, update to version 6.0.6 HF 1.6 or later. For Symantec Mail Security for Microsoft Exchange (SMSMSE) versions prior to 7.0 3966002 HF1.1, update to version 7.0 3966002 HF1.1 or later. For Symantec Mail Security for Microsoft Exchange (SMSMSE) versions 7.5.x prior to 7.5 3966008 VHF1.2, update to version 7.5 3966008 VHF1.2 or later. For Symantec Mail Security for Domino (SMSDOM) versions prior to 8.0.9 HF1.1, update to version 8.0.9 HF1.1 or later. For Symantec Mail Security for Domino (SMSDOM) versions 8.1.x prior to 8.1.3 HF1.2, update to version 8.1.3 HF1.2 or later. For CSAPI versions prior to 10.0.4 HF01, update to version 10.0.4 HF01 or later. For Symantec Message Gateway (SMG) versions prior to 10.6.1-4, update to version 10.6.1-4 or later. For Symantec Message Gateway for Service Providers (SMG-SP) version 10.5 before patch 254, apply patch 254 or later. For Symantec Message Gateway for Service Providers (SMG-SP) version 10.6 before patch 253, apply patch 253 or later. For Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 versions prior to NGC 22.7, update to NGC 22.7 or later. For Norton Security for Mac versions prior to 13.0.2, update to version 13.0.2 or later. For Norton Power Eraser (NPE) versions prior to 5.1, update to version 5.1 or later. For Norton Bootable Removal Tool (NBRT) versions prior to 2016.1, update to version 2016.1 or later.

Exploit

Fix

RCE

DoS

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-01697

CVE-2016-3644

Affected Products

Csapi

Norton 360

Norton Antivirus

Norton Bootable Removal Tool

Norton Internet Security

Norton Power Eraser

Norton Security

Norton Security For Mac

Symantec Advanced Threat Protection

Symantec Data Center Security:Server

Symantec Endpoint Protection

Symantec Endpoint Protection Client

Symantec Mail Security For Domino

Symantec Mail Security For Microsoft Exchange

Symantec Messaging Gateway

Symantec Message Gateway For Service Providers

Symantec Protection Engine

Symantec Protection For Sharepoint Servers

Symantec Web Gateway

References · 9

• 🔥 https://exploit-db.com/exploits/40034 · Exploit
• https://bdu.fstec.ru/vul/2016-01697 · Security Note
• https://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3644 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3644 · Vendor Advisory
• http://securitytracker.com/id/1036198 · Note
• http://securitytracker.com/id/1036199 · Note
• http://securityfocus.com/bid/91431 · Note
• https://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00 · Note