CVSS: 7.0EPSS: 0%CPEs: 8EXPL: 0CVE-2016-9093
https://notcve.org/view.php?id=CVE-2016-9093
A version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and earlier fails to properly sanitize logged-in user input. SEP 14.0 and later are not impacted by this issue. A non-admin user would need to be able to save an executable file to disk and then be able to successfully run that file. If properly constructed, the file could access the driver interface and potentially manipulate certain system calls. On all 32-bit systems and in most cases on 64-bit systems, this will result in a denial of service that will crash the system. • http://www.securityfocus.com/bid/96294 http://www.securitytracker.com/id/1037961 https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170306_00 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 3CVE-2018-9233 – Sophos Endpoint Protection Control Panel 10.7 - Weak Password Encryption
https://notcve.org/view.php?id=CVE-2018-9233
Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches. Sophos Endpoint Protection 10.7 emplea un hash SHA-1 sin sal para almacenar contraseñas en %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml. Esto facilita que los atacantes determinen una contraseña en texto claro y, por lo tanto, elijan configuraciones para malware inseguras mediante tablas rainbow u otros métodos. Sophos Endpoint Protection version 10.7 control panel authentication uses a weak unsalted unicoded cryptographic hash (SHA1) function. Not using a salt allows attackers that gain access to hash ability to conduct faster cracking attacks using pre-computed dictionaries, e.g. rainbow tables. • https://www.exploit-db.com/exploits/44411 http://hyp3rlinx.altervista.org/advisories/SOPHOS-ENDPOINT-PROTECTION-CONTROL-PANEL-v10.7-INSECURE-CRYPTO-CVE-2018-9233.txt http://seclists.org/fulldisclosure/2018/Apr/7 • CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 3CVE-2018-4863 – Sophos Endpoint Protection 10.7 - Tamper-Protection Bypass
https://notcve.org/view.php?id=CVE-2018-4863
Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\ registry key. Sophos Endpoint Protection 10.7 permite que usuarios locales omitan un mecanismo de protección contra manipulaciones mediante la eliminación de la clave de registro HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\. Sophos Endpoint Protection version 10.7 suffers from a tamper protection bypass vulnerability. • https://www.exploit-db.com/exploits/44410 http://hyp3rlinx.altervista.org/advisories/SOPHOS-ENDPOINT-PROTECTION-v10.7-TAMPER-PROTECTION-BYPASS-CVE-2018-4863.txt http://seclists.org/fulldisclosure/2018/Apr/6 • CWE-254: 7PK - Security Features •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-13680
https://notcve.org/view.php?id=CVE-2017-13680
Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use the product's UI to perform unauthorized file deletes on the resident file system. En versiones anteriores a SEP 12.1 RU6 MP9 SEP 14 RU1, el endpoint Symantec Endpoint Protection Windows puede encontrarse con una situación en la que un atacante podría emplear la interfaz de usuario del producto para realizar borrados no autorizados de archivos en el sistema de archivos residente. • http://www.securityfocus.com/bid/101503 http://www.securitytracker.com/id/1039775 https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20171106_00 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-13681
https://notcve.org/view.php?id=CVE-2017-13681
Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. In the circumstances of this issue, the capability of exploit is limited by the need to perform multiple file and directory writes to the local filesystem and as such, is not feasible in a standard drive-by type attack. Symantec Endpoint Protection, en versiones anteriores a SEP 12.1 RU6 MP9, podría ser susceptible a una vulnerabilidad de escalado de privilegios. Este tipo de problema permite que un usuario obtenga accesos elevados a recursos que, normalmente, suelen estar protegidos en niveles de acceso más bajos. En las circunstancias de este problema, la capacidad de este exploit está limitada por la necesidad de realizar varias escrituras de archivos y directorios al sistema de archivos local y, por lo tanto, no es posible en un ataque estándar de tipo drive-by. • http://www.securityfocus.com/bid/101504 http://www.securitytracker.com/id/1039775 https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20171106_00 •