CVE-2011-3007: Improper Control of Generation of Code

The myCIOScn ActiveX control myCIOScn.dll in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter, as demonstrated by injecting script into a log file and executing...

McAfee SaaS Endpoint Protection 'myCIOScn' ActiveX远程代码执行漏洞

Bugtraq ID: 49087 McAfee SaaS Endpoint Protection是一款提供了用于拦截病毒、间谍软件、Web 威胁和黑客攻击的基本保护功能。 myCIOScn.dll存在缺陷。首先通过ActiveX导出的MyCioScan.Scan.ReportFile参数可设置为任意文件名，包括敏感系统文件和目录，其次，可构建特制的MyCioScan.Scan.Start方法的参数，把恶意脚本注入到在AV扫描结束时创建的日志文件中。组合这两个缺陷可使远程攻击者以浏览器上下文执行任意代码。 0 McAfee SaaS Endpoint Protection 5.2.1...

McAfee SaaS Endpoint Protection 'MyAsUtil5.2.0.603.dll' ActiveX远程代码执行漏洞

Bugtraq ID: 49088 McAfee SaaS Endpoint Protection是一款提供了用于拦截病毒、间谍软件、Web 威胁和黑客攻击的基本保护功能。 MyAsUtil5.2.0.603.dll提供的ActiveX控件存在安全漏洞。首先跨站脚本可用于绕过MyASUtil.SecureObjectFactory.CreateSecureObject中实现的域执行策略来创建一个MyASUtil.InstallInfo实例，之后MyASUtil.InstallInfo.RunUserProgram可用于在系统上执行代码。另外用户系统上多个其他对象和接口可任意使用这个通用机...

Microsoft Forefront Endpoint Protection / System Center Endpoint Protection / Anti-malware Client Detection and Status

Microsoft Forefront Endpoint Protection, or another antimalware product from Microsoft, is installed on the remote host. However, there is a problem with the installation; either its services are not running or its engine and/or virus definitions are out of date. C Tenable Network Security, Inc...

Microsoft Products Malware Protection Engine权限提升漏洞

BUGTRAQ ID: 46540 CVE ID: CVE-2011-0037 Microsoft Malware Protection Engine是微软反恶意软件产品的一部分。 Malware Protection Engine产品的实现上存在设计问题，本地攻击者可利用此漏洞提升权限。 此漏洞源于Microsoft Malware Protection Engine在扫描时的错误，可通过设置注册表项的特制值提升权限。 Microsoft Microsoft Forefront Endpoint Protection 2010 Microsoft Microsoft Forefront...

Code injection

Microsoft Malware Protection Engine before 1.1.6603.0, as used in Microsoft Malicious Software Removal Tool MSRT, Windows Defender, Security Essentials, Forefront Client Security, Forefront Endpoint Protection 2010, and Windows Live OneCare, allows local users to gain privileges via a crafted val...

CVE-2011-0037

CVE-2011-0037 affects Microsoft Malware Protection Engine (MMPE) prior to 1.1.6603.0, used in MSRT, Windows Defender, Security Essentials, Forefront products, and related tools. The vulnerability allows local privilege escalation through a crafted value of an unspecified user registry key. The do...

PT-2011-2034

Name of the Vulnerable Software and Affected Versions Microsoft Malware Protection Engine versions prior to 1.1.6603.0 Microsoft Malicious Software Removal Tool MSRT affected versions not specified Windows Defender affected versions not specified Security Essentials affected versions not specifie...

Microsoft Issues Fix for Bug in Malware Protection Engine

Microsoft has issued an update to its core malware protection engine that fixes a bug that could allow an attacker to gain LocalSystem privileges on a vulnerable machine if a specific set of odd conditions exist. The vulnerability in the Microsoft Malware Protection Engine is a privilege-escalati...

CVE-2010-3268

The GetStringAMSHandler function in prgxhndl.dll in hndlrsvc.exe in the Intel Alert Handler service aka Symantec Intel Handler service in Intel Alert Management System AMS, as used in Symantec Antivirus Corporate Edition 10.1.4.4010 on Windows 2000 SP4 and Symantec Endpoint Protection before 11.x...

Cross site request forgery (csrf)

The GetStringAMSHandler function in prgxhndl.dll in hndlrsvc.exe in the Intel Alert Handler service aka Symantec Intel Handler service in Intel Alert Management System AMS, as used in Symantec Antivirus Corporate Edition 10.1.4.4010 on Windows 2000 SP4 and Symantec Endpoint Protection before 11.x...

CVE-2010-0114

fwcharts.php in the reporting module in the Manager aka SEPM component in Symantec Endpoint Protection SEP 11.x before 11 RU6 MP2 allows remote attackers to bypass intended restrictions on report generation, overwrite arbitrary PHP scripts, and execute arbitrary code via a crafted request...

Design/Logic Flaw

fwcharts.php in the reporting module in the Manager aka SEPM component in Symantec Endpoint Protection SEP 11.x before 11 RU6 MP2 allows remote attackers to bypass intended restrictions on report generation, overwrite arbitrary PHP scripts, and execute arbitrary code via a crafted request...

CVE-2010-0114

The CVE concerns Symantec Endpoint Protection Manager’s Reporting Module (fw_charts.php) where an attacker could overwrite PHP scripts and execute arbitrary code. Concrete details across sources: vulnerability exists in SEP 11.x prior to 11 RU6 MP2; the flaw is in the report-generation component ...

CVE-2010-3268: Improper Input Validation

The GetStringAMSHandler function in prgxhndl.dll in hndlrsvc.exe in the Intel Alert Handler service aka Symantec Intel Handler service in Intel Alert Management System AMS, as used in Symantec Antivirus Corporate Edition 10.1.4.4010 on Windows 2000 SP4 and Symantec Endpoint Protection before 11.x...

CVE-2010-0114: Improper Input Validation

fwcharts.php in the reporting module in the Manager aka SEPM component in Symantec Endpoint Protection SEP 11.x before 11 RU6 MP2 allows remote attackers to bypass intended restrictions on report generation, overwrite arbitrary PHP scripts, and execute arbitrary code via a crafted request...

Symantec Endpoint Protection File Overwrite

SUMMARY Symantec Endpoint Protection SEP Manager reporting module allows a php file overwrite from an authorized client that could potentially allow execution of arbitrary code on the server-side. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec Endpoint Protection | 11.x |...

PT-2010-1931

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions 11.x through 11 RU6 MP1 Description The issue allows remote attackers to bypass intended restrictions on report generation, overwrite arbitrary PHP scripts, and execute arbitrary code via a crafted request...

Symantec Endpoint Protection Manager Reporting Server fw_charts.php Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Endpoint Protection. Authentication is not required to exploit this vulnerability. The specific flaw exists within the portion of the server that generates reports. Due to the combination ...

Panda Security Partners with Brazilian Army to Combat Cyberterrorism

In an effort to combat cyberterrorism in Brazil, Panda Security has signed an agreement to support the training of the Brazilian Army’s operational agents. These agents are engaged in the battle against internet-based crime and strategic intervention for cyber warfare. Panda Security will also...