CVE-2016-9094
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs can be exported for review by the user in a variety of formats including .CSV files. Prior to 14.0 MP1 and 12.1 RU6 MP7, the potential exists for file metadata to be interpreted and evaluated as a formula. Successful exploitation of an attack of this type requires considerable direct user-interaction from the user exporting and then opening the log files on the intended target client.
Los clientes de Symantec Endpoint Protection colocan el malware detectado en cuarentena como parte de la funcionalidad planeada del producto. Los registros de cuarentena pueden ser exportados por el usuario para su revisión en una serie de formatos, incluyendo los archivos .CSV. En versiones anteriores a la 14.0 MP1 y a la 12.1 RU6 MP7, existe la posibilidad de que los metadatos del archivo se lean e interpreten como una fórmula. La explotación exitosa de un ataque de este tipo requiere una considerable interacción de usuario directa del usuario que realiza la exportación y la apertura de los archivos de registro en el cliente objetivo.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-10-28 CVE Reserved
- 2018-04-16 CVE Published
- 2023-09-07 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/96298 | Third Party Advisory | |
| http://www.securitytracker.com/id/1037961 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Symantec Search vendor "Symantec" | Endpoint Protection Search vendor "Symantec" for product "Endpoint Protection" | <= 14.0 Search vendor "Symantec" for product "Endpoint Protection" and version " <= 14.0" | - |
Affected
| ||||||
| Symantec Search vendor "Symantec" | Endpoint Protection Search vendor "Symantec" for product "Endpoint Protection" | 12.1.6 Search vendor "Symantec" for product "Endpoint Protection" and version "12.1.6" | mp7 |
Affected
| ||||||