Wednesday 27 June 2012

Symantec have fixed some exploits in Symantec Message Filter

Looks like Symantec have finally fixed some security issues I raised with them back in January 2012 for Symantec Message Filter 6.3.

It took them 6-months - so I am not impressed with their patching-cycle, or their focus on IT Security generally (this is supposed to be a security product after all).

Basically, as I described at BlackHat EU back in May 2012, this product-installer had versions of Tomcat and MySQL which were 7 years old, with default content and no patches (so the product had well-known third-party exploits right out of the box).

Additionally (which I felt I couldn't describe at the time, because it was 0-day) there were session-management and information-disclosure issues in the administrative UI, plus Cross Site Request Forgery (CSRF) of administrative-functions and XSS.

More detail is here:
http://www.symantec.com/security_response/securityupdates/detail.jsp?suid=20120626_00&fid=security_advisory&pvid=security_advisory&year=2012

The CVEs are:

CVE-2012-0300
CVE-2012-0301
CVE-2012-0302
CVE-2012-0303

9 comments:

  1. This comment has been removed by a blog administrator.

    ReplyDelete
  2. This comment has been removed by the author.

    ReplyDelete
  3. Hey Guys !

    USA Fresh & Verified SSN Leads with DL Number AVAILABLE with 99.9% connectivity
    All Leads have genuine & valid information

    **HEADERS IN LEADS**
    First Name | Last Name | SSN | Dob | DL Number | Address | City | State | Zip | Phone Number | Account Number | Bank Name | Employee Details | IP Address

    *Price for SSN lead $2
    *You can ask for sample before any deal
    *If anyone buy in bulk, we can negotiate
    *Sampling is just for serious buyers

    ==>ACTIVE, FRESH CC & CVV FULLZ AVAILABLE<==
    ->$5 PER EACH

    ->Hope for the long term deal
    ->Interested buyers will be welcome

    **Contact 24/7**
    Whatsapp > +923172721122
    Email > leads.sellers1212@gmail.com
    Telegram > @leadsupplier
    ICQ > 752822040

    ReplyDelete
  4. This is an excellent post I seen thanks to share it. It is really what I wanted to see hope in future you will continue for sharing such a excellent post
    wordpress
    blogspot
    youtube
    ស្លតកាស៊ីណូអនឡាញ

    ReplyDelete
  5. QUALITY SSN DOB DL HIGH CREDIT SCORES Leads
    CC with CVV Fullz (USA, UK, CANADA)
    Tutorials & E-Books For Ethical Hacking
    Tools For Everything You Need

    I'm On Telegram = @killhacks & I C Q = 752822040

    Stuff available for
    (Spamming, Carding, Ethical Hacking, LINUX, Programming, Scripting, etc. )

    Deals in all kind of Tools, Tutorials, E-books, Leads/Fullz/Pros
    Availability 24/7
    FASTEST DELIVERY

    Build Your Own Business with proper guide & Legit Tools
    Always glad to serve

    GOOD LUCK
    Here I'm:
    I C Q = 752822040
    Tele-gram = @killhacks

    ReplyDelete
  6. خطوات نقل الاثاث بشركة السلطان كبري شركات نقل العفش بالقاهرة


    التحقق من الوصول: قم بالتحقق من أن الأثاث يمكن الوصول إليه بسهولة في المكان الجديد وقم بتحديد مكان كل قطعة بشكل واضح.

    اختيار الوقت المناسب: حاول تحديد وقت مناسب لعملية النقل، حيث يكون الطقس جيدًا ولا يوجد ازدحام مروري كثير.

    ReplyDelete
  7. باتباع الخطوات التالية يمكنك نقل الأثاث بشكل صحيح وآمن دون أي مشاكل أو تلف وهي كالاتي :

    التحقق من الوصول: قم بالتحقق من أن الأثاث يمكن الوصول إليه بسهولة في المكان الجديد وقم بتحديد مكان كل قطعة بشكل واضح.

    استخدام خدماتافضل شركات نقل الاثاث بالقاهرة : إذا كنت تفضل ذلك، يمكنك الاستعانة بشركة نقل محترفة تتولى عملية النقل بالكامل بشكل صحيح وآمن.

    ReplyDelete