CVE-2005-3316

The installation of ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 creates the 1 DiscoveryWeb and 2 DiscoveryRO database accounts with null passwords, which could allow attackers to gain privileges or prevent Discovery from running by setting another password...

CVE-2005-3316

The CVE-2005-3316 entry describes a vulnerability in ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 where the installation creates two database accounts (DiscoveryWeb and DiscoveryRO) with null passwords. This could let an attacker gain privileges or disrupt Discovery by changing a passwo...

CVE-2005-3316

The installation of ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 creates the 1 DiscoveryWeb and 2 DiscoveryRO database accounts with null passwords, which could allow attackers to gain privileges or prevent Discovery from running by setting another password...

CVE-2005-3316: Undefined Security Weakness

The installation of ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 creates the 1 DiscoveryWeb and 2 DiscoveryRO database accounts with null passwords, which could allow attackers to gain privileges or prevent Discovery from running by setting another password...

Symantec Discovery unauthorized database access

Few accounts with empty passwords are created during installation...

[SA17302] Symantec Discovery Database Accounts Null Password

TITLE: Symantec Discovery Database Accounts Null Password SECUNIA ADVISORY ID: SA17302 VERIFY ADVISORY: http://secunia.com/advisories/17302/ CRITICAL: Moderately critical IMPACT: Manipulation of data, Exposure of sensitive information WHERE: From local network SOFTWARE: Symantec Discovery 6.x...

Symantec Discovery Web Accounts Null Password

SUMMARY Risk Impact Medium Remote Access | Yes ---|--- Local Access | Yes Authentication Required | No Exploit publicly available | NA AFFECTED PRODUCTS Product | Version | Solution ---|---|--- ON Command Discovery Standard Edition | 4.5.x | Downloadable Updates ON Command Discovery Web Edition |...

CVE-2005-3270

Untrusted search path vulnerability in DiskMountNotify for Symantec Norton AntiVirus 9.0.3 allows local users to gain privileges by modifying the PATH to reference a malicious 1 ps or 2 grep file...

Symantec Norton AntiVirus and another Symantec security products for Macintosh privilege escalation

Norton Antivirus DiskMountNotify suid utility executes external applications by relative name. LiveUpdate contains suid wrapper for Java interpreter without proper command line check...

[Full-disclosure] iDEFENSE Security Advisory 10.20.05: Symantec Norton AntiVirus LiveUpdate Local Privilege Escalation

Symantec Norton AntiVirus LiveUpdate Local Privilege Escalation iDEFENSE Security Advisory 10.20.05 www.idefense.com/application/poi/display?id=324&type=vulnerabilities October 20, 2005 I. BACKGROUND Symantec's Norton AntiVirus for Macintosh is an antivirus solution for the Mac OS X environment...

[Full-disclosure] iDEFENSE Security Advisory 10.20.05: Symantec Norton AntiVirus DiskMountNotify Local Privilege Escalation

Symantec Norton AntiVirus DiskMountNotify Local Privilege Escalation iDEFENSE Security Advisory 10.20.05 www.idefense.com/application/poi/display?id=325&type=vulnerabilities October 20, 2005 I. BACKGROUND Symantec's Norton AntiVirus for Macintosh is an antivirus solution for the Mac OS X...

CVE-2005-2759

SPLIT The jlucaller program in LiveUpdate for Symantec Norton AntiVirus 9.0.3 on Macintosh runs setuid when executing Java programs, which allows local users to gain privileges. NOTE: due to a CNA error, this candidate was also originally assigned to an issue in DiskMountNotify. Use CVE-2005-3270...

CVE-2005-3270

The CVE-2005-3270 entry concerns Symantec Norton AntiVirus 9.0.3 and a DiskMountNotify component. The vulnerability is an untrusted search path that allows local users to gain privileges by modifying the PATH to reference a malicious (1) ps or (2) grep file. This is a local privilege escalation i...

CVE-2005-2759

CVE-2005-2759 (LiveUpdate) and CVE-2005-3270 (DiskMountNotify) describe local privilege escalation in Symantec Norton AntiVirus for Macintosh 9.0.3. The illustrations show that the jlucaller binary (LiveUpdate) and DiskMountNotify are setuid root and rely on user-supplied input or PATH handling t...

CVE-2005-2759

SPLIT The jlucaller program in LiveUpdate for Symantec Norton AntiVirus 9.0.3 on Macintosh runs setuid when executing Java programs, which allows local users to gain privileges. NOTE: due to a CNA error, this candidate was also originally assigned to an issue in DiskMountNotify. Use CVE-2005-3270...

CVE-2005-3270

Untrusted search path vulnerability in DiskMountNotify for Symantec Norton AntiVirus 9.0.3 allows local users to gain privileges by modifying the PATH to reference a malicious 1 ps or 2 grep file...

[SA17268] Symantec Norton AntiVirus / LiveUpdate for Macintosh Privilege Escalation

TITLE: Symantec Norton AntiVirus / LiveUpdate for Macintosh Privilege Escalation SECUNIA ADVISORY ID: SA17268 VERIFY ADVISORY: http://secunia.com/advisories/17268/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system SOFTWARE: Symantec Norton Utilities for Macintosh 8.x...

CVE-2005-3270: Undefined Security Weakness

Untrusted search path vulnerability in DiskMountNotify for Symantec Norton AntiVirus 9.0.3 allows local users to gain privileges by modifying the PATH to reference a malicious 1 ps or 2 grep file...

CVE-2005-2759: Undefined Security Weakness

SPLIT The jlucaller program in LiveUpdate for Symantec Norton AntiVirus 9.0.3 on Macintosh runs setuid when executing Java programs, which allows local users to gain privileges. NOTE: due to a CNA error, this candidate was also originally assigned to an issue in DiskMountNotify. Use CVE-2005-3270...

Symantec LiveUpdate for Macintosh Local Privilege Escalation

SUMMARY Risk Impact Medium Remote Access | No ---|--- Local Access | Yes Authentication Required | Yes Exploit publicly available | No AFFECTED PRODUCTS Product | Version | Build | Language | Solution ---|---|---|---|--- LiveUpdate for Macintosh | 3.0.0 | All | All | Live Update Patch 3.0.1 | All...