Security Bypass in Symantec Norton App Lock
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-18373 |
| CWE-ID | CWE-264 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Norton App Lock Client/Desktop applications / Other client software |
| Vendor | Broadcom |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU22886
Risk: Low
CVSSv3.1: 4.9 [CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-18373
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a security-bypass vulnerability. An administrator with physical access can circumvent the app to prevent it from locking other apps on the device and gain access to the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNorton App Lock: 1.0.0.99 - 1.4.0.445
External linkshttp://support.symantec.com/us/en/article.SYMSA1496.html
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
