PT-2020-8047 · Symantec · Symantec Ghost Solution Suite+3

Published 2020-01-08 · Updated 2020-01-21 · CVE-2016-6590

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Symantec IT Management Suite versions 7.6 through 7.6 before HF7 Symantec IT Management Suite versions 8.0 through 8.0 before HF4 Symantec Ghost Solution Suite versions 3.1 through 3.1 before MP4 Symantec Endpoint Virtualization versions 7.x through 7.6 before HF7 Symantec Encryption Desktop versions 10.x through 10.4.0

Description: A privilege escalation issue exists when loading DLLs during boot up and reboot, which could let a local malicious user execute arbitrary code.

Recommendations: For Symantec IT Management Suite versions 7.6 through 7.6 before HF7, apply HF7 to resolve the issue. For Symantec IT Management Suite versions 8.0 through 8.0 before HF4, apply HF4 to resolve the issue. For Symantec Ghost Solution Suite versions 3.1 through 3.1 before MP4, apply MP4 to resolve the issue. For Symantec Endpoint Virtualization versions 7.x through 7.6 before HF7, apply HF7 to resolve the issue. For Symantec Encryption Desktop versions 10.x through 10.4.0, update to version 10.4.1 to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2016-6590

Affected Products

Symantec Encryption Desktop

Symantec Endpoint Virtualization

Symantec Ghost Solution Suite

Symantec It Management Suite

References · 5

• https://support.symantec.com/us/en/article.symsa1385.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6590 · Security Note
• http://securityfocus.com/bid/94279 · Note
• http://securitytracker.com/id/1037302 · Note