- Feb 7, 2014
- 1,540
- Content source
- http://www.kb.cert.org/vuls/id/252068
Symantec Endpoint Protection Client 11.x and 12.x contains a kernel pool overflow vulnerability.
CWE-788: Access of Memory Location After End of Buffer
An attacker logged into a Windows XP, Vista, 7, or 8 system as an unprivileged user is able to cause a kernel pool overflow in the sysplant driver with specially crafted IOCTL code. The sysplant driver is part of the Application and Device Control functionality in Symantec Endpoint Protection (SEP) client 11.x and 12.x. This feature is enabled by default in SEP client 11.x and 12.x.
here. A patch is now available, the new version is SEP 12.1.4112.4156.
If the patch is unavailable or cannot be installed, consider the following workaround:
Disable the Vulnerable Driver
By default, SEP has Application and Device Control enabled and loads the sysplant driver. Disabling the driver will prevent an attack from being successful, although it will marginally reduce the effectiveness of SEP. Note that the sysplant driver is still loaded if Application and Device Control is disabled either through the SEP client or via policy from the Symantec Endpoint Manager. Disabling the driver via a registry edit and rebooting the system will force it to unload the sysplant driver.
Follow these instructions on Symantec's site to disable the sysplant driver. The sysguard driver does not need to be disabled to mitigate this vulnerability.
Learn More)[/paste:font]
VendorStatusDate NotifiedDate Updated
SymantecAffected22 Jul 201401 Aug 2014
If you are a vendor and your product is affected, let us know.Learn More)[/paste:font]
GroupScoreVector
Base6.8AV:L/AC:L/Au:S/C:C/I:C/A:C
Temporal6.1E:F/RL:W/RC:C
Environmental4.6CDP:N/TD:M/CR:ND/IR:ND/AR:ND
http://www.symantec.com/business/support/index?page=content&id=TECH103259
CWE-788: Access of Memory Location After End of Buffer
An attacker logged into a Windows XP, Vista, 7, or 8 system as an unprivileged user is able to cause a kernel pool overflow in the sysplant driver with specially crafted IOCTL code. The sysplant driver is part of the Application and Device Control functionality in Symantec Endpoint Protection (SEP) client 11.x and 12.x. This feature is enabled by default in SEP client 11.x and 12.x.
here. A patch is now available, the new version is SEP 12.1.4112.4156.
If the patch is unavailable or cannot be installed, consider the following workaround:
Disable the Vulnerable Driver
By default, SEP has Application and Device Control enabled and loads the sysplant driver. Disabling the driver will prevent an attack from being successful, although it will marginally reduce the effectiveness of SEP. Note that the sysplant driver is still loaded if Application and Device Control is disabled either through the SEP client or via policy from the Symantec Endpoint Manager. Disabling the driver via a registry edit and rebooting the system will force it to unload the sysplant driver.
Follow these instructions on Symantec's site to disable the sysplant driver. The sysguard driver does not need to be disabled to mitigate this vulnerability.
Learn More)[/paste:font]
VendorStatusDate NotifiedDate Updated
SymantecAffected22 Jul 201401 Aug 2014
If you are a vendor and your product is affected, let us know.Learn More)[/paste:font]
GroupScoreVector
Base6.8AV:L/AC:L/Au:S/C:C/I:C/A:C
Temporal6.1E:F/RL:W/RC:C
Environmental4.6CDP:N/TD:M/CR:ND/IR:ND/AR:ND
http://www.symantec.com/business/support/index?page=content&id=TECH103259
