CVE-2016-3647: Undefined Security Weakness

Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery SSRF attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request...

Symantec Endpoint Protection Manager 12.1.x < 12.1 RU6 MP5 Multiple Vulnerabilities (SYM16-011)

The version of Symantec Endpoint Protection Manager SEPM installed on the remote host is prior to 12.1 RU6 MP5. It is, therefore, affected by the following vulnerabilities : - A race condition exists in the SEP client that allows a local attacker to bypass security restrictions, resulting in the...

PT-2016-2307

Name of the Vulnerable Software and Affected Versions Symantec Advanced Threat Protection ATP versions 6.x through 6.6 MP1 Symantec Data Center Security:Server SDCS:S versions 6.x through 6.6 MP1 Symantec Web Gateway affected versions not specified Symantec Endpoint Protection SEP versions prior ...

CVE-2016-3649: Exposure of Sensitive Information to an Unauthorized Actor

Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET requests...

Symantec Endpoint Protection 12.1 CSRF / XSS / Open Redirect

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SYMANTEC-SEPM-MULTIPLE-VULNS.txt + ISR: ApparitionSec Vendor: ================ www.symantec.com Product: =========== SEPM Symantec Endpoint Protection Manager and client v12.1...

Symantec AntiVirus - Unpacking RAR Multiple Remote Memory Corruptions

Symantec AntiVirus - Unpacking RAR Multiple Remote Memory Corruptions Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=810 A major component of the Symantec Antivirus scan engine is the "Decomposer", responsible for unpacking various archive formats such as ZIP, RAR, and so on. T...

Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SYMANTEC-SEPM-MULTIPLE-VULNS.txt + ISR: ApparitionSec Vendor: ================ www.symantec.com Product: =========== SEPM Symantec Endpoint Protection Manager and client v12.1...

Symantec AntiVirus - Unpacking RAR Multiple Remote Memory Corruptions

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=810 A major component of the Symantec Antivirus scan engine is the "Decomposer", responsible for unpacking various archive formats such as ZIP, RAR, and so on. The decomposer runs as NT AUTHORITY\SYSTEM on Windows, and root on Linu...

Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications + Credits: John Page aka HYP3RLINX + ISR: ApparitionSec Vendor: ================ www.symantec.com Product: =========== SEPM Symantec Endpoint Protection Manager and client v12.1 SEPM provides a centrally managed solution. It handles security...

Symantec Endpoint Protection Multiple Security Issues

SUMMARY Symantec Endpoint Protection SEP was susceptible to a number of security vulnerabilities potentially resulting in a user being able to leverage elevated privilege or access to unauthorized files on the management console. Additionally, a race condition in the device control of a SEP clien...

Symantec Decomposer Engine Multiple Parsing Vulnerabilities

SUMMARY Symantec is aware of buffer overflow and memory corruption findings in the AntiVirus Decomposer engine used in various configurations by multiple Symantec products. FAQ on Impact to Symantec Products: AFFECTED PRODUCTS Affected Enterprise Products Product | Version | Solutions ---|---|---...

How to Compromise the Enterprise Endpoint

Posted by Tavis Ormandy. Symantec is a popular vendor in the enterprise security market, their flagship product is Symantec Endpoint Protection. They sell various products using the same core engine in several markets, including a consumer version under the Norton brand. Today we’re publishing...

Threat Outbreak Alert RuleID22216: Email Messages Distributing Malicious Software on April 14, 2016

Medium Alert ID: 44658 First Published: 2016 April 14 13:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22216 may contain the following files: Name | Si...

Symantec Endpoint Protection Multiple Vulnerabilities (Mar 2016)

Symantec Endpoint Protection is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Symantec Endpoint Protection Manager < 12.1 RU6 MP4 Multiple Vulnerabilities (SYM16-003)

The version of Symantec Endpoint Protection Manager SEPM installed on the remote host is prior to 12.1 RU6 MP4. It is, therefore, affected by the following vulnerabilities : - A cross-site request forgery XSRF vulnerability exists due to HTTP requests to logging scripts not requiring multiple...

Symantec Endpoint Protection Client < 12.1 RU6 MP4 SysPlant.sys Driver RCE (SYM16-003)

The version of Symantec Endpoint Protection Client running on the remote host is 12.1 prior to 12.1 RU6 MP4. It is, therefore, affected by a remote code execution vulnerability due to insecure permissions for the SysPlant.sys driver. A remote attacker can exploit this, via a crafted HTML document...

Symantec Endpoint Protection Manager and Client Cross-Site Scripting Vulnerability

Symantec Endpoint Protection is a suite of antivirus software from Symantec Corporation in the U.S. SEP Manager and Client are the management and client software. A cross-site scripting vulnerability exists in Symantec Endpoint Protection Manager and Client, which allows remote attackers to explo...

Symantec Endpoint Protection Manager and Client Arbitrary Code Execution Vulnerability

Symantec Endpoint Protection is a suite of antivirus software from Symantec Corporation in the U.S. SEP Manager and Client are the management and client software. Symantec Endpoint Protection Manager and Client Sysplant.sys file for difficult to fully validate external data, allowing remote...

Symantec Endpoint Protection Manager and Client SQL Injection Vulnerability

Symantec Endpoint Protection is a suite of antivirus software from Symantec Corporation in the U.S. SEP Manager and Client are the management and client software. A SQL injection vulnerability exists in Symantec Endpoint Protection Manager and Client, which allows remote attackers to exploit the...

CVE-2015-8154

The SysPlant.sys driver in the Application and Device Control ADC component in the client in Symantec Endpoint Protection SEP 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to "RWX Permissions."...