Detections
Analytics
Symantec Endpoint Protection Manager < 11 RU7 MP2 (SYM12-007 / SYM12-008) (credentialed check)
high Nessus Plugin ID 59366
Language:
Synopsis
The endpoint management application installed on the remote Windows host has multiple vulnerabilities.Description
The version of Symantec Endpoint Protection Manager installed on the remote host is less than 11 RU7 MP2 (11.7.7200) and has the following vulnerabilities :- A denial of service vulnerability exists that could cause the web server to stop serving pages and, in some cases, crash the server. This vulnerability is only present on Windows 2003 systems with SP2 or below. (CVE-2012-1821)
- A buffer overflow exists that could allow a local attacker to elevate privileges. (CVE-2012-0289)
Solution
Upgrade to Symantec Endpoint Protection 11 RU7 MP2 or later.See Also
https://www.zerodayinitiative.com/advisories/ZDI-12-145/
https://seclists.org/fulldisclosure/2012/Aug/265
Plugin Details
Severity: High
ID: 59366
File Name: symantec_endpoint_prot_mgr_11_ru7_mp2.nasl
Version: 1.18
Type: local
Agent: windows
Family: Windows
Published: 6/5/2012
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.9
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 6.3
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:symantec:endpoint_protection_manager
Required KB Items: SMB/sep_manager/path, SMB/sep_manager/ver
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/22/2012
Vulnerability Publication Date: 5/22/2012
Reference Information
CVE: CVE-2012-0289, CVE-2012-1821
CERT: 149070