231 matches found
[SA19682] Symantec LiveUpdate for Machintosh Privilege Escalation
TITLE: Symantec LiveUpdate for Machintosh Privilege Escalation SECUNIA ADVISORY ID: SA19682 VERIFY ADVISORY: http://secunia.com/advisories/19682/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system SOFTWARE: Symantec Norton Utilities for Macintosh 8.x...
Symantec LiveUpdate for Macintosh Local Privilege Escalation
SUMMARY Some components of Symantec's LiveUpdate for Macintosh do not set their execution path environment Risk Impact Medium Remote Access | No ---|--- Local Access | Yes Authentication Required | Yes Exploit publicly available | No AFFECTED PRODUCTS Product | Version | Build | Language |...
Symantec Norton AntiVirus and another Symantec security products for Macintosh privilege escalation
Norton Antivirus DiskMountNotify suid utility executes external applications by relative name. LiveUpdate contains suid wrapper for Java interpreter without proper command line check...
[Full-disclosure] iDEFENSE Security Advisory 10.20.05: Symantec Norton AntiVirus LiveUpdate Local Privilege Escalation
Symantec Norton AntiVirus LiveUpdate Local Privilege Escalation iDEFENSE Security Advisory 10.20.05 www.idefense.com/application/poi/display?id=324&type=vulnerabilities October 20, 2005 I. BACKGROUND Symantec's Norton AntiVirus for Macintosh is an antivirus solution for the Mac OS X environment...
CVE-2005-2759
SPLIT The jlucaller program in LiveUpdate for Symantec Norton AntiVirus 9.0.3 on Macintosh runs setuid when executing Java programs, which allows local users to gain privileges. NOTE: due to a CNA error, this candidate was also originally assigned to an issue in DiskMountNotify. Use CVE-2005-3270...
CVE-2005-2759
SPLIT The jlucaller program in LiveUpdate for Symantec Norton AntiVirus 9.0.3 on Macintosh runs setuid when executing Java programs, which allows local users to gain privileges. NOTE: due to a CNA error, this candidate was also originally assigned to an issue in DiskMountNotify. Use CVE-2005-3270...
CVE-2005-2759
CVE-2005-2759 (LiveUpdate) and CVE-2005-3270 (DiskMountNotify) describe local privilege escalation in Symantec Norton AntiVirus for Macintosh 9.0.3. The illustrations show that the jlucaller binary (LiveUpdate) and DiskMountNotify are setuid root and rely on user-supplied input or PATH handling t...
CVE-2005-2759: Undefined Security Weakness
SPLIT The jlucaller program in LiveUpdate for Symantec Norton AntiVirus 9.0.3 on Macintosh runs setuid when executing Java programs, which allows local users to gain privileges. NOTE: due to a CNA error, this candidate was also originally assigned to an issue in DiskMountNotify. Use CVE-2005-3270...
Symantec LiveUpdate for Macintosh Local Privilege Escalation
SUMMARY Risk Impact Medium Remote Access | No ---|--- Local Access | Yes Authentication Required | Yes Exploit publicly available | No AFFECTED PRODUCTS Product | Version | Build | Language | Solution ---|---|---|---|--- LiveUpdate for Macintosh | 3.0.0 | All | All | Live Update Patch 3.0.1 | All...
Local LiveUpdate server username / password information revealed by client
SUMMARY Risk Impact Medium Remote Access | Yes ---|--- Local Access | Yes Authentication Required | Yes Exploit publicly available | No AFFECTED PRODUCTS Product | Version | Build | Solution ---|---|---|--- LiveUpdate Client | 2.7 | 34 | LiveUpdate Client Update ADDITIONAL PRODUCT INFORMATION...
CVE-2005-2766
The CVE affects Symantec AntiVirus Corporate Edition 9.0.1.x and 9.0.4.x (and possibly other versions) where, during updates from an internal LiveUpdate server, the Log.Liveupdate file stores the LiveUpdate username and password in cleartext. This plaintext credential exposure could allow an atta...
CVE-2005-2766
Symantec AntiVirus Corporate Edition 9.0.1.x and 9.0.4.x, and possibly other versions, when obtaining updates from an internal LiveUpdate server, stores sensitive information in cleartext in the Log.Liveupdate log file, which allows attackers to obtain the username and password to the internal...
CVE-2005-2766: Undefined Security Weakness
Symantec AntiVirus Corporate Edition 9.0.1.x and 9.0.4.x, and possibly other versions, when obtaining updates from an internal LiveUpdate server, stores sensitive information in cleartext in the Log.Liveupdate log file, which allows attackers to obtain the username and password to the internal...
symantecPassword.txt
The vulnerability has been identified and confirmed in versions 9.0.1.x and 9.0.4.x. I am fairly certain that it exists in all releases of version 9 and possibly other versions as well. Essentially, the program can be configured to receive updates via Symantec's or an Internal Live update server...
Symantec LiveUpdate privilege escalation
No description provided...
Secure Network Operations SNOsoft Research Team [SRT2004-12-14-0322] Symantec LiveUpdate Advisory
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Secure Network Operations, Inc. http://www.secnetops.com/research Strategic Reconnaissance Team researchatsecnetops.com Team Lead Contact JxTatsecnetops.com Spam Contact rm -rf /@snosoft.com Who we are: Secure Network Operations provides network...
CVE-2003-0994
The GUI functionality for an interactive session in Symantec LiveUpdate 1.70.x through 1.90.x, as used in Norton Internet Security 2001 through 2004, SystemWorks 2001 through 2004, and AntiVirus and Norton AntiVirus Pro 2001 through 2004, AntiVirus for Handhelds v3.0, allows local users to gain...
CVE-2003-0994
The CVE-2003-0994 issue affects Symantec LiveUpdate GUI between versions 1.70.x and 1.90.x, as used in Norton Internet Security 2001–2004, SystemWorks 2001–2004, and Antivirus/Norton Antivirus Pro 2001–2004, plus LiveUpdate for Handhelds v3.0. The vulnerability enables local users to escalate pri...
CVE-2003-0994: Undefined Security Weakness
The GUI functionality for an interactive session in Symantec LiveUpdate 1.70.x through 1.90.x, as used in Norton Internet Security 2001 through 2004, SystemWorks 2001 through 2004, and AntiVirus and Norton AntiVirus Pro 2001 through 2004, AntiVirus for Handhelds v3.0, allows local users to gain...
