SB2018062605 - Multiple vulnerabilities in Symantec Endpoint Protection

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018062605

SB2018062605 - Multiple vulnerabilities in Symantec Endpoint Protection

Published: June 26, 2018

Security Bulletin ID SB2018062605
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Race condition (CVE-ID: CVE-2018-5236)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to race condition when the output is dependent on the sequence or timing of other uncontrollable events. A local attacker can trigger race condition and cause the service to crash.


2) Privilege escalation (CVE-ID: CVE-2018-5237)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to unspecified flaw. A local attacker can gain elevated privileges and access arbitrary resources.


Remediation

Install update from vendor's website.

References