Symantec Endpoint Protection Manager < 11 RU7 MP2 (SYM12-007 / SYM12-008) (credentialed check)

High Nessus Plugin ID 59366

Synopsis

The endpoint management application installed on the remote Windows
host has multiple vulnerabilities.

Description

The version of Symantec Endpoint Protection Manager installed on the
remote host is less than 11 RU7 MP2 (11.7.7200) and has the following
vulnerabilities :

- A denial of service vulnerability exists that could
cause the web server to stop serving pages and, in some
cases, crash the server. This vulnerability is only
present on Windows 2003 systems with SP2 or below.
(CVE-2012-1821)

- A buffer overflow exists that could allow a local
attacker to elevate privileges. (CVE-2012-0289)

Solution

Upgrade to Symantec Endpoint Protection 11 RU7 MP2 or later.

See Also

https://www.zerodayinitiative.com/advisories/ZDI-12-145/

https://seclists.org/fulldisclosure/2012/Aug/265

http://www.nessus.org/u?3437fdf2

http://www.nessus.org/u?3d2da8cd

Plugin Details

Severity: High

ID: 59366

File Name: symantec_endpoint_prot_mgr_11_ru7_mp2.nasl

Version: 1.18

Type: local

Agent: windows

Family: Windows

Published: 2012/06/05

Modified: 2018/11/15

Dependencies: 59365

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:symantec:endpoint_protection_manager

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2012/06/22

Vulnerability Publication Date: 2012/05/22

Reference Information

CVE: CVE-2012-0289, CVE-2012-1821

BID: 50358, 51795

CERT: 149070

EDB-ID: 18916