The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors.

The remote Symantec Data Center Security Server running on the remote host is affected by an information disclosure vulnerability in the '/webui/admin/environment.jsp' script, which discloses sensitive information about the server and software configuration.

The version of Symantec Critical System Protection (SCSP) installed on the remote Windows host is 5.2.9.x prior to 5.2.9 MP6. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in the     Management Server Agent Control Interface due to     improper sanitization of user-uploaded files. An     authenticated, remote attacker can exploit this, by     uploading a log file, to execute arbitrary script code     with the privileges of the web server. (CVE-2014-3440)

  - A SQL injection (SQLi) vulnerability exists in the     management server due to the /sis-ui/authenticate script     not properly sanitizing user-supplied input to the 'ai'     POST parameter. An unauthenticated, remote attacker can     exploit this to inject or manipulate SQL queries in the     back-end database, resulting in the manipulation or     disclosure of arbitrary data. (CVE-2014-7289)

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the management server in the     WCUnsupportedClass.jsp script and SSO-Error.jsp script     due to improper validation of user-supplied input to the     'classname' and 'ErrorMsg' GET parameters. An     unauthenticated, remote attacker can exploit this to     execute arbitrary script code in a user's browser     session. (CVE-2014-9224)

  - An information disclosure vulnerability exists in the     management server due to a failure to properly restrict     internal server information. An authenticated, remote     attacker can exploit this, via a direct request to the     environment.jsp script, to disclose sensitive server     information. (CVE-2014-9225)

  - A privilege escalation vulnerability exists due to a     failure to sufficiently restrict access to certain host     functionality. A local attacker can exploit this to     bypass protection policies and gain elevated privileges.
    (CVE-2014-9226)

  - A SQL injection (SQLi) vulnerability exists in the     management server due to improper sanitization of     user-supplied input. An authenticated, remote attacker     can exploit this to inject or manipulate SQL queries in     the back-end database, resulting in the manipulation or     disclosure of arbitrary data. (CVE-2015-8157)

  - A path traversal issue exists due to improper     sanitization of user-supplied input. An authenticated,     remote attacker can exploit this, via a specially     crafted request, to execute arbitrary code.
    (CVE-2015-8798)

  - A path traversal issue exists that allows an     authenticated, remote attacker to write update-package     data to arbitrary agent locations, resulting in the     execution of arbitrary code. (CVE-2015-8799)

  - An unspecified flaw exists that is triggered when     handling process calls written to a specific named pipe.
    An authenticated, remote attacker can exploit this to     inject arbitrary arguments. (CVE-2015-8800)

ID	Name	Product	Family	Severity
81551	Symantec Data Center Security Server 'environment.jsp' Information Disclosure (SYM15-001)	Nessus	CGI abuses	medium
80911	Symantec Critical System Protection 5.2.9.x < 5.2.9 MP6 Multiple Vulnerabilities (SYM15-001 / SYM16-009)	Nessus	Windows	high

Detections

Analytics

CVE-2014-9225

medium

Tenable Plugins

medium

high