OpenSSL Vulnerabilities Mar 2021

Summary Symantec Network and Information Security NIS products using affected versions of OpenSSL may be susceptible to two vulnerabilities. A remote attacker may be able to cause denial of service through application crashes. An application may successfully validate an invalid X.509 certificate...

Exploit for CVE-2020-12593

CVE-2020-12593 CVE-2020-12593 POC Symantec EDR on-prem versio...

Exploit for CVE-2020-5839

CVE-2020-5839 CVE-2020-5839 POC Symantec EDR on-prem version...

Exploit for Cross-site Scripting in Symantec Endpoint_Detection_And_Response

CVE-2019-19547 CVE-2019-19547 POC Symantec EDR on-prem versio...

APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign

Why is the campaign called A41APT? In 2019, we observed an APT campaign targeting multiple industries, including the Japanese manufacturing industry and its overseas operations, that was designed to steal information. We named the campaign A41APT not APT41 which is derived from the host name...

Debian DLA-2593-1 : ca-certificates whitelist Symantec CA

This update reverts the Symantec CA blacklist which was originally 911289. The following root certificates were added back + : + 'GeoTrust Global CA' + 'GeoTrust Primary Certification Authority' + 'GeoTrust Primary Certification Authority - G2' + 'GeoTrust Primary Certification Authority - G3' +...

DLA-2593-1 ca-certificates - whitelist Symantec CA

Bulletin has no description...

[SECURITY] [DLA 2593-1] ca-certificates whitelist Symantec CA

----------------------------------------------------------------------- Debian LTS Advisory DLA-2593-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 14, 2021 https://wiki.debian.org/LTS -...

OpenSSL Vulnerabilities Sep 2020 - Feb 2021

Summary Symantec Network and Information Security NIS products using affected versions of OpenSSL may be susceptible to multiple vulnerabilities. A remote attacker may be able to decrypt encrypted communication from an SSL/TLS connection, downgrade a newly established SSL/TLS connection to SSLv2,...

Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop

More than a month into the discovery of Solorigate, investigations continue to unearth new details that prove it is one of the most sophisticated and protracted intrusion attacks of the decade. Our continued analysis of threat data shows that the attackers behind Solorigate are skilled campaign...

Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop

More than a month into the discovery of Solorigate, investigations continue to unearth new details that prove it is one of the most sophisticated and protracted intrusion attacks of the decade. Our continued analysis of threat data shows that the attackers behind Solorigate are skilled campaign...

Researchers Discover Raindrop — 4th Malware Linked to the SolarWinds Attack

Cybersecurity researchers have unearthed a fourth new malware strain—designed to spread the malware onto other computers in victims' networks—which was deployed as part of the SolarWinds supply chain attack disclosed late last year. Dubbed "Raindrop" by Broadcom-owned Symantec, the malware joins...

SolarWinds Issues Second Hotfix for Orion Platform Supply Chain Attack

Network monitoring services provider SolarWinds officially released a second hotfix to address a critical vulnerability in its Orion platform that was exploited to insert malware and breach public and private entities in a wide-ranging espionage campaign. In a new update posted to its advisory...

Symantec Messaging Gateway Security Vulnerability

Symantec Messaging Gateway is a suite of spam filters from Symantec USA. The product features anti-spam, anti-virus, advanced content filtering, and data leakage protection. A security vulnerability exists in Symantec Messaging Gateway prior to version 10.7.4, which can be exploited by attackers ...

Symantec Messaging Gateway Authorization Issues Vulnerability

Symantec Messaging Gateway is a suite of spam filters from Symantec USA. The product features anti-spam, anti-virus, advanced content filtering, and data leakage protection. An authorization issue vulnerability exists in Symantec Messaging Gateway prior to version 10.7.4. The vulnerability arises...

Privilege Escalation and Information Disclosure Vulnerabilities in SMG

Summary Symantec Messaging Gateway SMG is susceptible to privilege escalation and information disclosure vulnerabilities. A malicious, authenticated, privileged user can further elevate their privileges on the system, or obtain a password for a remote SCP backup server that they might not otherwi...

Symantec Reports on Cicada APT Attacks against Japan

Symantec is reporting on an APT group linked to China, named Cicada. They have been attacking organizations in Japan and elsewhere. Cicada has historically been known to target Japan-linked organizations, and has also targeted MSPs in the past. The group is using living-off-the-land tools as well...

APT Exploits Microsoft Zerologon Bug: Targets Japanese Companies

China-backed APT Cicada joins the list of threat actors leveraging the Microsoft Zerologon bug to stage attacks against their targets. In this case, victims are large and well-known Japanese organizations and their subsidiaries, including locations in the United States. Researchers observed a...

Symantec Endpoint Detection

Symantec Endpoint Detection And Response uses AI, IR automation and threat intelligence to detect, find, isolate and eliminate intrusions across all endpoints. symantec Endpoint Detection...

CVE-2020-12593

Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data...