PT-2016-3866 · Symantec · Critical System Protection+2

Published 2016-06-08 · Updated 2021-09-09 · CVE-2015-8157

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Embedded Security: Critical System Protection (SES:CSP) versions 1.0.x through 1.0 before MP5 Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) version 6.5.0 before MP1 Critical System Protection (SCSP) versions prior to 5.2.9 MP6 Data Center Security: Server Advanced Server (DCS:SA) versions 6.x through 6.4 and version 6.6 before MP1 Data Center Security: Server Advanced Server and Agents (DCS:SA) versions prior to 6.6 MP1

Description A SQL injection issue in the Management Server allows remote authenticated users to execute arbitrary SQL commands.

Recommendations For Symantec Embedded Security: Critical System Protection (SES:CSP) versions 1.0.x, update to 1.0 MP5 or later. For Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) version 6.5.0, update to MP1 or later. For Critical System Protection (SCSP), update to 5.2.9 MP6 or later. For Data Center Security: Server Advanced Server (DCS:SA) versions 6.x, update to 6.5 MP1 or later, and for version 6.6, update to MP1 or later. For Data Center Security: Server Advanced Server and Agents (DCS:SA), update to 6.6 MP1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-8157

Affected Products

Critical System Protection

Data Center Security: Server Advanced Server

Symantec Embedded Security: Critical System Protection

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-8157 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160607_00 · Vendor Advisory
• http://securityfocus.com/bid/90889 · Note