Symantec has released an update to address two issues in the Symantec Endpoint Encryption product.
Symantec Endpoint Encryption (SEE)
|
|
CVE-2017-15525
CVE-2017-15526
|
Prior to 11.1.3MP1
|
Upgrade to 11.1.3MP1
CVE-2017-15525
Severity/CVSSv3:
|
Medium / 4.2 AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
References:
Impact:
|
Securityfocus: BID 101697 / NVD: CVE-2017-15525
Denial of service
Description:
|
A denial of service (DoS) attack is a type of attack whereby the perpetrator attempts to make a particular machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a specific host within a network. DoS attacks can occur when a system becomes flooded with specific network requests or subversive operations that can cause the resourced system to become unresponsive.
CVE-2017-15526
Severity/CVSSv3:
|
Low / 4.2 AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
References:
Impact:
|
Securityfocus: BID 101698 / NVD: CVE-2017-15526
Privilege escalation
Description:
|
Symantec Endpoint Encryption can be susceptible to a null pointer de-reference issue, which can result in a NullPointerException that can lead to a privilege escalation scenario. A null-pointer dereference takes place when a pointer with a value of NULL is used as though it pointed to a valid memory area.
These issues were validated by the product team engineers. A Symantec Endpoint Encryption update, version SEE v11.1.3MP1, has been released which addresses the aforementioned issues. Note that the latest releases and patches for Symantec Endpoint Encryption are available to customers through normal support channels. At this time, Symantec is not aware of any exploitations or adverse customer impact from these issues.
Symantec recommends the following measures to reduce risk of attack: