Symantec Endpoint Protection Vulnerability Advisory: CVE-2017-13681, 13680, 6331

Critical Vulnerability Information Overview Symantec has released a set of updates to address three issues in Symantec Endpoint Protection (SEP) products. Issues Affected Products Enterprise Symantec Endpoint Protection 12.1 RU6 MP9 and earlier – Upgrade to Symantec Endpoint Protection 12.1 RU6 MP9 Symantec Endpoint Protection 12.1 RU6 MP9 and earlier, and SEP 14 RU1 and earlier – Upgrade to Symantec Endpoint Protection 12.1 RU6 MP9 or SEP 14 RU1 Symantec Endpoint Protection 12.1.X and SEP 14 RU1 and earlier – Upgrade to Symantec Endpoint Protection 14 RU1 Issue Details Single Choice: Endpoint Protection Privilege Escalation (CVE-2017-13681) BID: 101504 Severity: High (CVSSv3: 8.8) Impact: Privilege Escalation Exploitability: None Patch Date: October 20, 2017 Single Choice: Arbitrary File Deletion (CVE-2017-13680) BID: 101504 Severity: Medium (CVSSv3: 6.5) Impact: Arbitrary File Deletion Exploitability: None Patch Date: October 20, 2017 SEP Protection Bypass (CVE-2017-6331) BID: 101502 Severity: Low (CVSSv3: 2.8) Impact: Protection Bypass Exploitability: None Patch Date: October 20, 2017 Mitigation These issues have been validated by the product team engineers. The latest SEP updates, version 12.1 RU6 MP9 and 14 RU1, resolve these vulnerabilities. Ensure you apply the necessary patches and updates. Best Practices Restrict access to management systems to authorized users only Allow remote access only from trusted/authorized systems Run with minimal privileges to limit potential exploitation impact Keep all operating systems and applications up to date with the latest patches Implement a layered security approach, combining at least firewall and anti-malware Deploy network and host-based intrusion detection systems to detect anomalous activities Acknowledgments Matthieu Buffet, representing ANSSI (CVE-2017-13681) Clément Lavoillotte (@clavoillotte) (CVE-2017-13680) John Page AKA hyp3rlinx Apparitionsec (CVE-2017-6331)

Goal Reached Thanks to every supporter — we hit 100%!

Symantec Endpoint Protection Vulnerability Advisory: CVE-2017-13681, 13680, 6331