Initial Publication Date: Advisory Status: Advisory Severity: CVSS Base Score:Legacy ID
23 Apr 2014 Closed Low 2.6 SYM14-007
Symantec’s Encryption Desktop is susceptible to memory access violations when attempting to parse specific malformed certificate files. This could result in a possible application crash if a malicious individual could entice an authorized user to successfully click on a malformed file.
Symantec Encryption Desktop Block Data Move Read Access Violation
Symantec was notified of Symantec Encryption Desktop’s improper handling of data when parsing specifically formatted certificates. Attempting to open such a malformed file type could potentially result in memory access violations when the application attempts to parse the file. The identified issues include memory copy and block data move read access violations. Successful exploitation of these memory read access violations would likely result in a possibility of an application crash.
The certificate file type identified as resulting in the memory read access violations is not a format that is normally used in network communications. Attempted exploitation would only be possible if the malicious individual were able to successfully entice an authorized user to double click and attempt parsing a specifically formatted certificate that had been introduced into the user’s environment.
However, to prevent even the low probability of success of this type of issue, Symantec engineers have released an update in Symantec Encryption Desktop 10.3.2 maintenance pack 1 addressing the issue.
Customers may obtain Symantec Desktop Encryption maintenance updates through their normal Symantec support locations.
As part of normal best practices, Symantec strongly recommends:
Restrict access to administration or management systems to privileged users.
Disable remote access if not required or restrict it to trusted/authorized systems only.
Where possible, limit exposure of application and web interfaces to trusted/internal networks only.
Keep all operating systems and applications updated with the latest vendor patches.
Follow a multi-layered approach to security. Run both firewall and anti-malware applications, at a minimum, to provide multiple points of detection and protection to both inbound and outbound threats.
Deploy network and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in detection of attacks or malicious activity related to exploitation of latent vulnerabilities
Symantec thanks Jeremy Brown (jerbrown) of ReSP working through Microsoft Vulnerability Research, MSVR, for reporting this and working with us as we addressed it.
BID:Security Focus, http://www.securityfocus.com, has assigned a Bugtraq ID (BID) to this issue for inclusion in the Security Focus vulnerability database.
CVE:This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
This is machine translated content
Login to Subscribe
Please login to set up your
Would you like to be subscribed to future notifications for this article?
For security reasons, your link to this document has expired. Please click on the attachment link to access this file.
The attachment that you are looking for no longer exists.
There has been an issue retrieving your attachment. Please try again.
Currently server is down.
Didn't find the article you were looking for? Try these resources.