SEP Vulnerabiltiy

[IN]

Our vulnerabiity scanning software has identified SYM14-001 CVE-2013-5010 as a vulnerability.  If I undertand Symantec's response to this, we need to upgrade to 12.1 ru2 or higher.  On all of the machines i've checked that were identified as having this vulnerability, all are running 12.1.2015.2015.  What do i need to do to remediate this SEP vulnerability?

 

Thank you. 

[ℬrίαη]

How are you detecting this vuln? Are you scanning the machines? You're right this was fixed in 12.1.2 so it shouldn't show up for those versions. Have you tried upgrading to the latest version, 12.1.4?

This vulnerability affected application and device control, do you use it?

Symantec Endpoint Protection Application/Device Control Policy Security Bypass Vulnerability

http://www.securelist.com/en/advisories/56345

[Migration User]

Security Advisories Relating to Symantec Products - Symantec Endpoint Protection Privilege Assumption, Policy Bypass, Local Elevation of Privilege

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20140109_00

[IN]

We do not use that at this time.  We may in the near future.  We just had to upgrade over 5000 clients to 12.1.2015 and 2093.  I'm very hesitant to tell them we need to do yet another upgrade so soon after the last. 

 

[ℬrίαη]

This was fixed in 12.1.2 (the version you're on) How is this being detected again, via scan?

 

[IN]

It is.  we finished our upgrade at the end of september and it's still picking it up.

 

[ℬrίαη]

So all clients are at 12.1.2?

Doesn't really make sense since it was fixed in this version.

I would suggest a support call to find out what to do next...

[IN]

we use McAfee Foundstone Vulnerability Management software

 

[ℬrίαη]

Hang on for a few minutes, let me scan a few of my clients...

[Rafeeq]

Please upgrade to 12.1.4 check this article from Symantec employee

https://www-secure.symantec.com/connect/forums/upgrade-sepm-and-clients-correct-new-vulnerabilities-cve-2013-5009-cve-2013-5010-cve-2013-501

[ℬrίαη]

I'm not seeing this vuln come up on our clients with 12.1.2 and higher. My suggestion would be to first verify the client is at at least this version and if still showing than contact support.

Ideally, if you can upgrade than you need to do so.