Symantec's Encryption Desktop for OS X installs some temporary files with world-writable attributes during installation. In a multi-user environment, a malicious user could manipulate these world-writable files to read and write files or create files with another user's permissions.
Product
|
Version
|
Build
|
Solution
—|—|—|—
Symantec PGP Desktop for OS X
|
10.0.x
10.1.x
10.2.x
|
All
|
Symantec Encryption Desktop 10.3.2 Maintenance Pack 2
Symantec Encryption Desktop Professional for OS X
|
10.3.0
10.3.1
10.3.2
|
All
|
Symantec Encryption Desktop 10.3.2 Maintenance Pack 2
CVSS2
Base Score
|
Impact
|
Exploitability
|
CVSS2 Vector
—|—|—|—
Symantec Encryption Desktop for OS X World-Writable Files Insecure File Handling
4.25
|
6.4
|
3.1
|
AV:L/AC:L/AU:S/C:P/I:P/A:P
CVE
|
BID
|
Description
—|—|—
CVE-2014-3431
|
BID 68077
|
Symantec Encryption Desktop for OS X World-Writable Files Insecure File Handling
Details
Symantec was notified of Symantec Encryption Desktop for OS X installing temporary files with world-writeable permissions. In a multi-user environment, a malicious user could manipulate these weak file permissions to create new files or change permissions on an existing file with another user's permissions whenever the targeted user accesses Symantec Encryption Desktop. This could potentially allow an authorized but non-privileged user to gain unauthorized access to or create arbitrary files with another system user's potentially privileged access.
Symantec Response
Symantec engineers verified these finding and have released an update in Symantec Encryption Desktop 10.3.2 maintenance pack 2 for OS X addressing the issue.
Update information
Customers may obtain Symantec Desktop Encryption maintenance updates through their normal Symantec support locations.
Best Practices
As part of normal best practices, Symantec strongly recommends:
Symantec would like to thank Aaron Sigel for reporting this and working with Symantec as we addressed it.
BID: Security Focus, http://www.securityfocus.com, has assigned a Bugtraq ID (BID) to this issue for inclusion in the Security Focus vulnerability database.
CVE: This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.