PT-2018-11073 · Symantec · Symantec Endpoint Protection

Published 2018-11-29 · Updated 2018-12-28 · CVE-2018-12245

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions prior to 14.2 MP1

Description The issue is related to a DLL Preloading vulnerability, which occurs when an application unintentionally loads a DLL provided by a potential attacker during installation. This exploit only manifests at install time and does not affect already installed software. The problem was specific to the Trialware media for Symantec Endpoint Protection.

Recommendations For Symantec Endpoint Protection versions prior to 14.2 MP1, update to version 14.2 MP1 or later to resolve the issue.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2018-12245

Affected Products

Symantec Endpoint Protection

References · 4

• https://osv.dev/vulnerability/CVE-2018-12245 · Vendor Advisory
• https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1468.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12245 · Security Note
• http://securityfocus.com/bid/105919 · Note