02/03/06 - added CVE identifier
02/07/06 - updated Credit section
02/09/06 - added Solaris build information
04/17/06 - added information on the availability of proof of concept code
|Exploit publicly available||Yes|
A SQL injection vulnerability in Symantec's Sygate Management Server (SMS) version 4.1, build 1417 and earlier could potentially allow a remote or local attacker to gain administrative privileges to the SMS server.
|SMS (English)||3.5||Windows||MR 3 build 894 or earlier||ftp://SMS35b895@18.104.22.168|
|SMS (English)||4.0||Windows||MR 1 build 1104 and earlier||ftp://SMS40B1105@22.214.171.124|
|Solaris||MR 1 build 1104 and earlier|| |
|SMS (English)||4.1||Windows||MR 2 build 1417 and earlier||ftp://SSE41MR2@126.96.36.199|
|Solaris||MR 2 build 1417 and earlier|| |
|SMS 4.1 (Chinese)||4.1|| ||MR1 build 1351 and earlier||ftp://SMS1352c@188.8.131.52|
|SMS 4.1 GA (Japanese)||4.1|| ||GA build 1258 and earlier||See Note|
Note: Please contact Technical Support to obtain the password needed to download these updates.
The Japanese version of SMS is distributed through Macnica Inc. Please contact your Macnica Support representative to obtain this update.
Symantec was notified of a vulnerability in Symantec's Sygate Management Server. An attacker with network or local access to the SMS Server could inject code into a URL which would potentially allow the attacker to overwrite the password for any SMS account, including the SMS administrator account. If successful, the attacker could then use that new password to access the SMS console with full administrator privileges. This would allow the attacker to disable all agents, or to propagate an exploit script to all managed agents.
Symantec engineers have verified that this vulnerability exists in the product versions listed above, and have provided updates to resolve the issue.
Fixed builds for this issue can be downloaded from the locations listed in the table above. Select your supported version of Symantec SMS and use the login credentials that were provided by Enterprise Support to download the appropriate update. If you need additional assistance, please contact Enterprise Support.
Note: Supported products will be updated to address this vulnerability. If you are using a product version or maintenance release earlier than those listed in the table above, you will need to upgrade to the most currently supported version of your product.
To help reduce the risks associated with this vulnerability until you are able to apply the patches or updates, Symantec recommends the following:
Restrict access to the SMS console by using its internal network ACL. Then, specify the IP addresses of valid administrators so they will have access to the console.
Restrict access to the vulnerable SMS applet by using IIS' ACL
Details on these mitigation steps are located in the same ftp location as the product builds.
As a part of normal best practices, users should keep vendor-supplied patches for all application software and operating systems up-to-date. Symantec strongly recommends customers immediately apply the updates for their products to protect against possible attacks.
Symantec is not aware of any customers impacted by this vulnerability. On April 13, 2006, proof of concept code to exploit this issue was made available.
This issue is a candidate for inclusion in the Common Vulnerabilities and Exposures (CVE) list (http://cve.mitre.org), which standardizes names for security problems.
The CVE initiative has assigned CVE Candidate CVE-2006-0522 to this issue.
Symantec would like to thank Guillaume Goutaudier and Nicolas Gregoire at Exaprobe, SAS, France for reporting this issue, and working with us on the resolution.
Symantec takes the security and proper functionality of our products very seriously. As founding members of the Organization for Internet Safety (OISafety), Symantec supports and follows the principles of responsible disclosure. Symantec also subscribes to the vulnerability disclosure guidelines outlined by the National Infrastructure Advisory Council (NIAC).
Please contact email@example.com if you feel you have discovered a security issue in a Symantec product. A Symantec Product Security team member will contact you regarding your submission. Symantec strongly recommends using encrypted email for reporting vulnerability information to firstname.lastname@example.org. The Symantec Product Security PGP key can be found at the end of this message.
Symantec has developed a Product Vulnerability Response document outlining the process we follow in addressing suspected vulnerabilities in our products. This document is available below.
Copyright © by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from email@example.com.
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Symantec, Symantec products, Symantec Security Response, and firstname.lastname@example.org are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.
Initial Post on: Wednesday, 01-Feb-06 07:05:00
Last modified on: Monday, 17-Apr-2006 15:22:00 PDT