CVE-2017-6331

Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that bypasses the real time protection for the application that is run on servers and clients...

CVE-2017-13681

Symantec Endpoint Protection (SEP) is affected by CVE-2017-13681, a privilege-escalation flaw in SEP prior to 12.1 RU6 MP9. The issue requires multiple file and directory writes to the local filesystem, limiting exploit feasibility to non-drive-by scenarios. Impact is described as elevated access...

CVE-2017-13680

Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use the product's UI to perform unauthorized file deletes on the resident file system...

CVE-2017-13680

Summary: CVE-2017-13680 affects Symantec Endpoint Protection (SEP) Windows endpoints. The vulnerability allows an attacker to perform unauthorized file deletions via the product UI. Affected versions are SEP 12.1 RU6 MP9 and SEP 14 RU1. Root cause/impact: UI-driven file deletion on the resident f...

CVE-2017-13681

Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. In the circumstances of this issue, the...

CVE-2017-6331

Symantec Endpoint Protection (SEP) up to 12.1.6 RU6 MP5 / 12.1.x before RU6 MP9 or 14.0 before RU1 is affected by CVE-2017-6331. The issue is a Tamper-Protection Bypass caused by SEP not validating WinAPI message sources (UIPI), allowing spoofed UI messages to potentially disable or bypass real‑t...

Symantec Endpoint Protection Multiple Issues

SUMMARY Symantec has released a set of updates to address three issues in the Symantec Endpoint Protection SEP product. AFFECTED PRODUCTS Symantec Endpoint Protection SEP --- CVE | Affected Versions | Remediation CVE-2017-13681 | Prior to 12.1 RU6 MP9 | Upgrade to 12.1 RU6 MP9 Symantec Endpoint...

October 24, 2017 – Morning Cyber Coffee Headlines – “Niagara Falls” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 24, 2017 - Headlines Carbon Black in the News: Putting the P, D, and R...

Partner Perspective: Integrated Endpoint Protection and Response

Editor's Note: The post originally appeared on LogRhythm.com Maintaining visibility of hundreds—if not thousands—of endpoints and then taking corrective actions to the discovered abnormalities is a critical security challenge many organizations face today. Most organizations dedicate substantial...

The WireX Botnet warning Bulletin-vulnerability warning-the black bar safety net

2017 8 May 17, named WireX BotNet the botnet by masquerading ordinary Android applications the way a large number of infected Android devices and launched a large-scaleDDoSattack, this caused a portion of the CDN provider's note, and thereafter from Akamai, Cloudflare, Dragon Age, Google, Oracle...

Black Hat 2017: training, cybersecurity trends and end-point protection

Every year, Black Hat is a highly anticipated event in the cybersecurity community--and Black Hat 2017 certainly did not disappoint! It was yet another year of record traffic, bustling with visitors from the security community that want to strengthen their security skills and postures...

KLA11154 Multiple vulnerabilities in Microsoft Windows, Forefront Endpoint Protection and Exchange Server

Multiple vulnerabilities were found in Microsoft Systems. alicious users can exploit these vulnerabilities to execute arbitrary code. An error of scanning specially crafted file can be exploited remotely to execute arbitrary code. Technical details Vulnerabilities is affected Windows Defender for...

July 11, 2017 – Morning Cyber Coffee Headlines – “MLB All-Star Game” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 11, 2017 - Headlines Carbon Black in the News: Forbes Ranks Carbon Black A...

A week in security (June 26 – July 02)

Last week, we offered our readers tips on how to detect phishing attempts, gave an overview of Google's Be Internet Awesome campaign, supplemented an ongoing series on adware, and introduced the Malwarebytes Endpoint Protection to those who aren't already in the know. We also pushed out a number ...

4 Cybersecurity Principles That Withstand the Test of Time

Information security can be a noisy place. I’ve been a “security guy” my entire career and have been lucky enough to have a wide range of experiences: software development, IT security in a very large enterprise, vulnerability research and exploitation, and now as an enterprise software vendor...

Solution Corner: Malwarebytes Endpoint Protection

We’ve been busy here at Malwarebytes with several product announcements recently. Malwarebytes Incident Response was released in late April, providing threat detection and remediation via our new cloud-based platform. Right on its heels, leveraging the same platform is Malwarebytes Endpoint...

KLA11843 ACE vulnerability in Microsoft System Center

A remote code execution vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2017-8558 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such...

Microsoft Malware Protection Engine < 1.1.13903 RCE

The version of Microsoft Malware Protection Engine MMPE installed on the remote Windows host is prior to 1.1.13903.0. It is, therefore, affected by a remote code execution vulnerability due to improper handling of files during scanning. An unauthenticated, remote attacker can exploit this, via a...

Symantec Endpoint Protection Client 12.1.x < 12.1 RU6 MP7 / 14.0.x < 14.0 MP1 Command Injection (SYM17-002)

The version of Symantec Endpoint Protection SEP Client installed on the remote host is 12.1.x prior to 12.1 RU6 MP7 or 14.0.x prior to 14.0 MP1. It is, therefore, affected by a command injection vulnerability when handling quarantine logs due to file metadata being improperly interpreted and...

Palo Alto Networks Traps ESM Console Denial of Service Vulnerability

Palo Alto Networks Traps is a suite of endpoint protection suite software from Palo Alto Networks, U.S.A. ESM Console is one of the ESM consoles. A security vulnerability exists in ESM Console in Palo Alto Networks Traps prior to version 3.4.4, which stems from the program failing to properly...