The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to write to arbitrary files, and consequently obtain administrator privileges, via a crafted filename.

The version of Symantec Endpoint Protection Manager (SEPM) running on the remote host is prior to 12.1 RU6 MP1. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the password reset functionality that     allows a remote attacker, using a crafted password reset     action, to generate a new administrative session, thus     bypassing authentication. (CVE-2015-1486)

  - A flaw exists related to filename validation in a     console session that allows an authenticated, remote     attacker to write arbitrary files. (CVE-2015-1487)

  - An unspecified flaw exists that allows an authenticated,     remote attacker to manipulate SEPM services and gain     elevated privileges. (CVE-2015-1489)

Nessus attempts to use the authentication bypass flaw in conjunction with the arbitrary file upload and path traversal flaws to test the issue on the remote server. If this test succeeds, it is likely that the application is also affected by other vulnerabilities, including a SQL Injection.

The version of Symantec Endpoint Protection Manager (SEPM) installed on the remote host is prior to 12.1 RU6 MP1. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the password reset functionality that     allows a remote attacker, using a crafted password reset     action, to generate a new administrative session, thus     bypassing authentication. (CVE-2015-1486)

  - A flaw exists related to filename validation in a     console session that allows an authenticated, remote     attacker to write arbitrary files. (CVE-2015-1487)

  - A flaw exists in an unspecified action handler that     allows an authenticated, remote attacker to read     arbitrary files. (CVE-2015-1488)

  - An unspecified flaw exists that allows an authenticated,     remote attacker to manipulate SEPM services and gain     elevated privileges. (CVE-2015-1489)

  - A flaw exists that allows traversing outside of a     restricted path, due to a failure to properly sanitize     user-supplied input. An authenticated, remote attacker,     using a specially crafted installation package, can     exploit this to access files outside of the restricted     path. (CVE-2015-1490)

  - A SQL injection vulnerability exists due to a failure to     properly sanitize user-supplied input before building     SQL queries. An authenticated, remote attacker can     exploit this to disclose or manipulate data in the     back-end database. (CVE-2015-1491)

  - A flaw in how Symantec Endpoint Protection clients load     dynamic-link libraries allows an authenticated attacker     to replace legitimate client libraries with malicious     ones, thus injecting executable code. (CVE-2015-1492)

  - A flaw exists in the /servlet/AgentServlet script due to     improper sanitization of user-supplied input before     using it in SQL queries. An unauthenticated, remote     attacker can exploit this to inject or manipulate SQL     queries against the back-end database, resulting in the     disclosure or manipulation of arbitrary data.

  - A flaw exists in the SecurityAlertNotifyTask class due     to improper sanitization of user-supplied input. An     authenticated, remote attacker can exploit this to     execute arbitrary commands.

  - A flaw exists in Rtvscan.exe related to searching and     loading dynamic-link library (DLL) files due to using     an insecure search path which may include directories     that are not trusted or under the user's control. An     attacker can exploit this, by injecting a crafted DLL     file into path, to execute arbitrary code with the     privileges of the user.

ID	Name	Product	Family	Severity
85351	Symantec Endpoint Protection Manager < 12.1 RU6 MP1 Multiple Vulnerabilities (SYM15-007)	Nessus	CGI abuses	high
85256	Symantec Endpoint Protection Manager 11.x / 12.x < 12.1 RU6 MP1 Multiple Vulnerabilities (SYM15-007)	Nessus	Windows	high

Detections

Analytics

CVE-2015-1487

high

Tenable Plugins

high

high