PT-2017-9947 · Symantec · Symantec Endpoint Protection+1

Published 2017-03-06 · Updated 2018-05-23 · CVE-2016-9093

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions 12.1 RU6 MP6 and earlier

Description The issue is related to the SymEvent Driver's failure to properly sanitize logged-in user input. This could allow a non-admin user to potentially manipulate certain system calls by saving and running a specially constructed executable file. The impact can range from a denial of service, causing the system to crash, to allowing the user to run arbitrary code on the local machine with kernel-level privileges in very specific circumstances on 64-bit systems. This could result in a non-privileged user gaining privileged access on the local machine.

Recommendations For Symantec Endpoint Protection versions 12.1 RU6 MP6 and earlier, update to a version later than 14.0 to resolve the issue. As a temporary workaround, consider restricting access to the SymEvent Driver interface to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-9093

Affected Products

Symantec Endpoint Protection

Symantec Endpoint Protection Client

References · 5

• https://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170306_00 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9093 · Security Note
• http://securityfocus.com/bid/96294 · Note
• http://securitytracker.com/id/1037961 · Note