7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
The management GUI for Symantec LiveUpdate Administrator does not properly protect the forgotten password functionality of the web interface. An unauthorized individual with knowledge of the email address for an authorized LUA user can potentially force an arbitrary password reset leading to unauthorized access.
The management GUI for Symantec LiveUpdate Administrator does not sufficiently sanitize the inputs for the queries made against the backend database which could lead to unauthorized access to data stored in the database.
Product
|
Version
|
Build
|
Solution(s)
โ|โ|โ|โ
Symantec LiveUpdate Administrator
|
2.x
|
2.3.2 and prior
|
Upgrade to LUA 2.3.2.110
Products not affected
Product
|
Version
|
Build
โ|โ|โ
Symantec LiveUpdate Administrator
|
1.x
|
All
CVSS2
Base Score
|
Impact
|
Exploitability
|
CVSS2 Vector
โ|โ|โ|โ
LUA Unauthenticated/Unauthorized Account Access Modification 7.9 - High
7.9
|
10
|
5.5
|
LUA Unauthenticated SQL Injections 6.9 - Medium
6.3
|
8.5
|
5.5
|
CVE
|
BID
|
Description
โ|โ|โ
CVE-2014-1644
|
BID 66399
|
LUA Unauthorized Account Access Modification
CVE-2014-1645
|
BID 66400
|
LUA Unauthenticated SQL Injection
Details
The Symantec LiveUpdate Administrator management web interface does provide proper protection for the login/password functionality. An authorized but malicious network user or an unauthorized malicious individual who can gain access to the network environment could potentially force a password reset of an authorized LUA user. The attacker would require knowledge of an authorized LUA user's email address to attempt to force an arbitrary password reset. If successful, this could allow full access to the administrator web interface.
The Symantec LiveUpdate Administrator management web interface does not sufficiently sanitize inputs to queries made against the database which could lead to unauthorized access to data stored in the database. Successful exploitation could potentially expose sufficient information allowing access to other LiveUpdate Administrator servers on the network or the capability to force network or CPU denial -of-service of network clients by providing extraneous files for download to client systems.
In a normal, recommended installation, the Symantec LiveUpdate Administrator management web interface should not be accessible external to the network which should provide some mitigation against external but not internal attacks. An external attacker would need to gain network access to launch this type of attack. This would normally entail enticing an authorized network user to access a malicious link in a context such as a web link or in an email to initially compromise a client system on the network.
Symantec Response
Symantec product engineers verified these issues and have released updates to resolve them. Customers should apply the available updates to Symantec LiveUpdate Administrator 2.3.2. Symantec is not aware of exploitation of or adverse customer impact from these issues.
Update Information
Symantec LiveUpdate Administrator update version 2.3.2.110is currently available for upgrade as identified in Symantec Support knowledge base article TECH 134809, http://www.symantec.com/business/support/index?page=content&id=TECH134809
Best Practices
As part of normal best practices, Symantec strongly recommends the following:
Symantec thanks Stefan Viehbock (discovery, analysis, coordination) from the SEC Consult Vulnerability Lab (https://www.sec-consult.com/) for reporting these issues and working with us as we addressed them.
BID: Security Focus, http://www.securityfocus.com, has assigned Bugtraq IDs (BIDs) to these issues for inclusion in the Security Focus vulnerability database.
CVE: These issues are candidates for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
CPE | Name | Operator | Version |
---|---|---|---|
symantec liveupdate administrator | eq | 2 |