SB2018120308 - Multiple vulnerabilities in Symantec Endpoint Protection
Published: December 3, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Insecure DLL loading (CVE-ID: CVE-2018-12245)
The vulnerability allows a local high-privileged attacker to compromise vulnerable system.
The vulnerability exists due to insecure .dll loading mechanism when opening files. A remote attacker can place a file along with specially crafted .dll file on a remote SBM or WebDAV share, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current victim.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Security restrictions bypass (CVE-ID: CVE-2018-12238)
The vulnerability allows a local attacker to bypass security restrictions on the target system.
The vulnerability exists due to an error when one of the antivirus engines depends on a signature pattern from a database to identify malicious files and viruses. A local attacker can circumvent one of the virus detection engines to avoid a specific type of virus protection.
3) Security restrictions bypass (CVE-ID: CVE-2018-12239)
The vulnerability allows a physical high-privileged attacker to bypass security restrictions on the target system.
The vulnerability exists due to an error when one of the antivirus engines depends on a signature pattern from a database to identify malicious files and viruses. A physical attacker can circumvent one of the virus detection engines to avoid a specific type of virus protection.
Remediation
Install update from vendor's website.