SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   Symantec Endpoint Protection Vendors:   Symantec
Symantec Endpoint Protection Input Validation Flaw in Log Viewer Permits Remote HTML Injection Attacks
SecurityTracker Alert ID:  1022135
SecurityTracker URL:  http://securitytracker.com/id/1022135
CVE Reference:   CVE-2009-1428   (Links to External Site)
Date:  Apr 28 2009
Impact:   Disclosure of user information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 11.0
Description:   A vulnerability was reported in Symantec Endpoint Protection. A remote user can conduct HTML injection attacks.

The Log Viewer (ccLgView.exe) does not properly filter HTML code from user-supplied input before displaying the input. A remote user can send an e-mail containing specially crafted arbitrary JavaScript code. When the target user views the event log via the 'View Logs - Email Filtering' option from the Statistics option of the Symantec Log Viewer, the arbitrary scripting code will be executed on the target user's system. The code may be able to access data on the viewer or take actions on the viewer acting as the target user.

Mark Litchfield from Next Generation Security Software reported this vulnerability.

Impact:   A remote user may be able to access data on the viewer take actions on the viewer acting as the target user.
Solution:   The vendor has issue a fix (11.0 MR1).

The vendor's advisory is available at:

http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_01

Vendor URL:  www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_01 (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC