SEP Multiple Issues

SUMMARY

Symantec has released updates to address issues that were discovered in the Norton, Symantec Endpoint Protection (SEP), Symantec Endpoint Protection Small Business Edition (SEP SBE) and Symantec Endpoint Protection Cloud (SEP Cloud) products.

AFFECTED PRODUCTS

Norton

---

CVE

|

Affected Version(s)

|

Remediation

CVE-2018-12238,

CVE-2018-12239

|

Prior to 22.15

|

Upgrade to 22.15 (or higher)

Symantec Endpoint Protection (SEP)

---

CVE

|

Affected Version(s)

|

Remediation

CVE-2018-12238,

CVE-2018-12239

|

Prior to 12.1.7454.7000 & 14.2

|

Upgrade to 12.1.7454.7000 or 14.2

Symantec Endpoint Protection Small Business Edition (SEP SBE)

---

CVE

|

Affected Version(s)

|

Remediation

CVE-2018-12238,

CVE-2018-12239

|

Prior to NIS-22.15.1.8 &

SEP-12.1.7454.7000

|

Upgrade to NIS-22.15.1.8 or

SEP-12.1.7454.7000

Symantec Endpoint Protection Cloud (SEP Cloud)

---

CVE

|

Affected Version(s)

|

Remediation

CVE-2018-12238,

CVE-2018-12239

|

Prior to 22.15.1

|

Upgrade to 22.15 .1

Symantec Endpoint Protection (SEP)

---

CVE

|

Affected Version(s)

|

Remediation

CVE-2018-12245

|

Prior to 14.2 MP1

|

Upgrade to 14.2 MP1

ISSUES

CVE-2018-12238

---

Severity/CVSSv3:

|

Medium / 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References:

Impact:

|

Security Focus: BID 105917 / NVD: CVE-2018-12238

AV Bypass

Description:

|

This type of exploit works to circumvent one of the virus detection engines to avoid a specific type of virus protection. One of the antivirus engines depends on a signature pattern from a database to identify malicious files and viruses; the antivirus bypass exploit looks to alter the file being scanned so it is not detected.

CVE-2018-12239

---

Severity/CVSSv3:

|

Medium / 6.1 AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References:

Impact:

|

Security Focus: BID 105918 / NVD: CVE-2018-12239

AV Bypass

Description:

|

This type of exploit works to circumvent one of the virus detection engines to avoid a specific type of virus protection. One of the antivirus engines depends on a signature pattern from a database to identify malicious files and viruses; the antivirus bypass exploit looks to alter the file being scanned so it is not detected.

CVE-2018-12245

---

Severity/CVSSv3:

|

Medium / 6.3 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

References:

Impact:

|

Security Focus: BID 105919 / NVD: CVE-2018-12245

DLL Preloading

Description:

|

Symantec Endpoint Protection may be susceptible to a DLL Preloading vulnerability, which in this case is an issue that can occur when an application being installed unintentionally loads a DLL provided by a potential attacker. Note that this particular type of exploit only manifests at install time; no remediation is required for software that has already been installed. This issue only impacted the Trialware media for Symantec Endpoint Protection, which has since been updated.

MITIGATION

The aforementioned issues were validated by product team engineers. A set of product security updates to mitigate the listed issues are as follows:

• Norton version 22.15 (or higher)
• Symantec Endpoint Protection (SEP) versions 12.1.7454.7000 & 14.2 (or higher)
• Symantec Endpoint Protection Small Business Edition (SEP SBE) versions NIS-22.15.1.8 & SEP-12.1.7454.7000
• Symantec Endpoint Protection Cloud (SEP Cloud) version 22.15
• Symantec Endpoint Protection (SEP) version 14.2 MP1

Note that the latest releases of the mentioned products are available to customers through normal support channels. At this time, Symantec is not aware of any exploitations or adverse customer impact from these issues.

Symantec recommends the following measures to reduce risk of attack:

• Restrict access to administrative or management systems to authorized privileged users.
• Restrict remote access to trusted/authorized systems only.
• Run under the principle of least privilege, where possible, to limit the impact of potential exploit.
• Keep all operating systems and applications current with vendor patches.
• Follow a multi-layered approach to security. At a minimum, run both firewall and anti-malware applications to provide multiple points of detection and protection for both inbound and outbound threats.
• Deploy network and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in the detection of attacks or malicious activity related to the exploitation of latent vulnerabilities.

ACKNOWLEDGEMENTS

• CVE-2018-12238: Reported by Qualys Malware Research Lab
• CVE-2018-12239: Baranov Artem <[email protected]>
• CVE-2018-12245: Pierre-Alexandre Braeken