Symantec Critical System Protection 5.2.9.x < 5.2.9 MP6 Multiple Vulnerabilities (SYM15-001 / SYM16-009)

high Nessus プラグイン ID 80911

Language:

概要

リモート Windows ホストにセキュリティアプリケーションがインストールされており、これは複数の脆弱性の影響を受けます。

説明

The version of Symantec Critical System Protection (SCSP) installed on the remote Windows host is 5.2.9.x prior to 5.2.9 MP6. したがって、以下の複数の脆弱性による影響を受けます。

- A remote code execution vulnerability exists in the Management Server Agent Control Interface due to improper sanitization of user-uploaded files. An authenticated, remote attacker can exploit this, by uploading a log file, to execute arbitrary script code with the privileges of the web server. (CVE-2014-3440)

- A SQL injection (SQLi) vulnerability exists in the management server due to the /sis-ui/authenticate script not properly sanitizing user-supplied input to the 'ai' POST parameter. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the manipulation or disclosure of arbitrary data. (CVE-2014-7289)

- Multiple cross-site scripting (XSS) vulnerabilities exist in the management server in the WCUnsupportedClass.jsp script and SSO-Error.jsp script due to improper validation of user-supplied input to the 'classname' and 'ErrorMsg' GET parameters. An unauthenticated, remote attacker can exploit this to execute arbitrary script code in a user's browser session. (CVE-2014-9224)

- An information disclosure vulnerability exists in the management server due to a failure to properly restrict internal server information. An authenticated, remote attacker can exploit this, via a direct request to the environment.jsp script, to disclose sensitive server information. (CVE-2014-9225)

- A privilege escalation vulnerability exists due to a failure to sufficiently restrict access to certain host functionality. A local attacker can exploit this to bypass protection policies and gain elevated privileges.
(CVE-2014-9226)

- A SQL injection (SQLi) vulnerability exists in the management server due to improper sanitization of user-supplied input. An authenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the manipulation or disclosure of arbitrary data. (CVE-2015-8157)

- A path traversal issue exists due to improper sanitization of user-supplied input. 認証されていないリモートの攻撃者がこれを悪用し、特別に細工されたリクエストで任意のコードを実行する可能性があります。
(CVE-2015-8798)

- A path traversal issue exists that allows an authenticated, remote attacker to write update-package data to arbitrary agent locations, resulting in the execution of arbitrary code. (CVE-2015-8799)

- An unspecified flaw exists that is triggered when handling process calls written to a specific named pipe.
An authenticated, remote attacker can exploit this to inject arbitrary arguments. (CVE-2015-8800)