Results 1 to 4 of 4

Thread: Symantec Anti-Virus LiveUpdate Credentials Disclosure

  1. September 5th, 2005, 08:12 PM #1
    ByTeWrangler
    ByTeWrangler is offline
    StOrM™
    Join Date
    Aug 2004
    Posts
    1,003

    Symantec Anti-Virus LiveUpdate Credentials Disclosure

    Greeting's


    The security issue is caused due to the client storing the LiveUpdate Server login name and password to a local log file in clear text. This can be exploited by malicious users to disclose the configured login name and password for accessing the LiveUpdate packages.

    Although this vulnerability is classified as : Less Critical. I have posted it so that Admin's get a head's up.

    Product version's affected : Symantec AntiVirus Corporate Edition 9.x

    Symantec Windows LiveUpdate 2.x


    Solution : Update to version 2.7.38.


    Original Advisory :

    http://securityresponse.symantec.com...005.09.02.html
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.
    Reply With Quote Reply With Quote
  2. September 5th, 2005, 08:22 PM #2
    576869746568617
    576869746568617 is offline
    Yes, that's my CC number! 576869746568617's Avatar
    Join Date
    Dec 2003
    Location
    Earth
    Posts
    397
    Yet another update to download...yeah! Thanks for the heads up. Maybe I'll just upgrade to Corporate 10.
    Windows 9x: n. A collection of 32 bit extensions and a graphical shell for a 16 bit patch to an 8 bit operating system originally coded for a 4 bit microprocessor. Written by a 2 bit company that can\'t stand 1 bit of competition.

    Reply With Quote Reply With Quote
  3. September 6th, 2005, 03:46 AM #3
    cashmoney
    cashmoney is offline
    Member
    Join Date
    Jun 2005
    Posts
    34
    There is a work around for this, but I have not been able to find that clear text passwords are stored.
    to SYN, or not to SYN. That is the question. -Shakespeare?
    Reply With Quote Reply With Quote
  4. September 6th, 2005, 06:35 AM #4
    warl0ck7
    warl0ck7 is offline
    Senior Member
    Join Date
    Jun 2003
    Posts
    188
    I don't understand that how such big security companies make such stupid mistakes.

    www.securityfocus.com is run by Symantec
    www.@stake.com has been acquired by Symantec.

    God knows what the hell are they upto.
    http://i12.photobucket.com/albums/a2...l0ck9/Sig5.gif
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules