How to Compromise the Enterprise Endpoint

Posted by Tavis Ormandy. Symantec is a popular vendor in the enterprise security market, their flagship product is Symantec Endpoint Protection. They sell various products using the same core engine in several markets, including a consumer version under the Norton brand. Today we’re publishing...

Threat Outbreak Alert RuleID22216: Email Messages Distributing Malicious Software on April 14, 2016

Medium Alert ID: 44658 First Published: 2016 April 14 13:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22216 may contain the following files: Name | Si...

Symantec Endpoint Protection Multiple Vulnerabilities (Mar 2016)

Symantec Endpoint Protection is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Symantec Endpoint Protection Client < 12.1 RU6 MP4 SysPlant.sys Driver RCE (SYM16-003)

The version of Symantec Endpoint Protection Client running on the remote host is 12.1 prior to 12.1 RU6 MP4. It is, therefore, affected by a remote code execution vulnerability due to insecure permissions for the SysPlant.sys driver. A remote attacker can exploit this, via a crafted HTML document...

Symantec Endpoint Protection Manager < 12.1 RU6 MP4 Multiple Vulnerabilities (SYM16-003)

The version of Symantec Endpoint Protection Manager SEPM installed on the remote host is prior to 12.1 RU6 MP4. It is, therefore, affected by the following vulnerabilities : - A cross-site request forgery XSRF vulnerability exists due to HTTP requests to logging scripts not requiring multiple...

Symantec Endpoint Protection Manager and Client Cross-Site Scripting Vulnerability

Symantec Endpoint Protection is a suite of antivirus software from Symantec Corporation in the U.S. SEP Manager and Client are the management and client software. A cross-site scripting vulnerability exists in Symantec Endpoint Protection Manager and Client, which allows remote attackers to explo...

Symantec Endpoint Protection Manager and Client SQL Injection Vulnerability

Symantec Endpoint Protection is a suite of antivirus software from Symantec Corporation in the U.S. SEP Manager and Client are the management and client software. A SQL injection vulnerability exists in Symantec Endpoint Protection Manager and Client, which allows remote attackers to exploit the...

Symantec Endpoint Protection Manager and Client Arbitrary Code Execution Vulnerability

Symantec Endpoint Protection is a suite of antivirus software from Symantec Corporation in the U.S. SEP Manager and Client are the management and client software. Symantec Endpoint Protection Manager and Client Sysplant.sys file for difficult to fully validate external data, allowing remote...

CVE-2015-8154

The SysPlant.sys driver in the Application and Device Control ADC component in the client in Symantec Endpoint Protection SEP 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to "RWX Permissions."...

CVE-2015-8153

SQL injection vulnerability in Symantec Endpoint Protection Manager SEPM 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-8152

Cross-site request forgery CSRF vulnerability in Symantec Endpoint Protection Manager SEPM 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Symantec Endpoint Protection Manager SEPM 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script...

Sql injection

SQL injection vulnerability in Symantec Endpoint Protection Manager SEPM 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Hardcoded credentials

The SysPlant.sys driver in the Application and Device Control ADC component in the client in Symantec Endpoint Protection SEP 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to "RWX Permissions."...

CVE-2015-8153

Symantec Endpoint Protection Manager (SEPM) 12.1 prior to RU6-MP4 is affected by CVE-2015-8153 (SQL injection). Interfaces with the SEPM backend allow a remote authenticated attacker to execute arbitrary SQL via unspecified vectors, potentially impacting data confidentiality, integrity, and avail...

CVE-2015-8152

Cross-site request forgery CSRF vulnerability in Symantec Endpoint Protection Manager SEPM 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script...

CVE-2015-8152

CVE-2015-8152 affects Symantec Endpoint Protection Manager (SEPM) 12.1 up to RU6-MP4. The issue is a cross-site request forgery (CSRF) vulnerability in logging scripts that enables a remote authenticated attacker to hijack administrator authentication and execute arbitrary code through crafted lo...

CVE-2015-8154

Symantec Endpoint Protection Client

CVE-2015-8153

SQL injection vulnerability in Symantec Endpoint Protection Manager SEPM 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-8154

The SysPlant.sys driver in the Application and Device Control ADC component in the client in Symantec Endpoint Protection SEP 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to "RWX Permissions."...