Symantec has released updates to address issues that were discovered in the Norton, Symantec Endpoint Protection (SEP), Symantec Endpoint Protection Small Business Edition (SEP SBE) and Symantec Endpoint Protection Cloud (SEP Cloud) products.
Norton
CVE
|
Affected Version(s)
|
Remediation
CVE-2018-12238,
CVE-2018-12239
|
Prior to 22.15
|
Upgrade to 22.15 (or higher)
Symantec Endpoint Protection (SEP)
CVE
|
Affected Version(s)
|
Remediation
CVE-2018-12238,
CVE-2018-12239
|
Prior to 12.1.7454.7000 & 14.2
|
Upgrade to 12.1.7454.7000 or 14.2
Symantec Endpoint Protection Small Business Edition (SEP SBE)
CVE
|
Affected Version(s)
|
Remediation
CVE-2018-12238,
CVE-2018-12239
|
Prior to NIS-22.15.1.8 &
SEP-12.1.7454.7000
|
Upgrade to NIS-22.15.1.8 or
SEP-12.1.7454.7000
Symantec Endpoint Protection Cloud (SEP Cloud)
CVE
|
Affected Version(s)
|
Remediation
CVE-2018-12238,
CVE-2018-12239
|
Prior to 22.15.1
|
Upgrade to 22.15 .1
Symantec Endpoint Protection (SEP)
CVE
|
Affected Version(s)
|
Remediation
CVE-2018-12245
|
Prior to 14.2 MP1
|
Upgrade to 14.2 MP1
CVE-2018-12238
Severity/CVSSv3:
|
Medium / 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References:
Impact:
|
Security Focus: BID 105917 / NVD: CVE-2018-12238
AV Bypass
Description:
|
This type of exploit works to circumvent one of the virus detection engines to avoid a specific type of virus protection. One of the antivirus engines depends on a signature pattern from a database to identify malicious files and viruses; the antivirus bypass exploit looks to alter the file being scanned so it is not detected.
CVE-2018-12239
Severity/CVSSv3:
|
Medium / 6.1 AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References:
Impact:
|
Security Focus: BID 105918 / NVD: CVE-2018-12239
AV Bypass
Description:
|
This type of exploit works to circumvent one of the virus detection engines to avoid a specific type of virus protection. One of the antivirus engines depends on a signature pattern from a database to identify malicious files and viruses; the antivirus bypass exploit looks to alter the file being scanned so it is not detected.
CVE-2018-12245
Severity/CVSSv3:
|
Medium / 6.3 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
References:
Impact:
|
Security Focus: BID 105919 / NVD: CVE-2018-12245
DLL Preloading
Description:
|
Symantec Endpoint Protection may be susceptible to a DLL Preloading vulnerability, which in this case is an issue that can occur when an application being installed unintentionally loads a DLL provided by a potential attacker. Note that this particular type of exploit only manifests at install time; no remediation is required for software that has already been installed. This issue only impacted the Trialware media for Symantec Endpoint Protection, which has since been updated.
The aforementioned issues were validated by product team engineers. A set of product security updates to mitigate the listed issues are as follows:
Note that the latest releases of the mentioned products are available to customers through normal support channels. At this time, Symantec is not aware of any exploitations or adverse customer impact from these issues.
Symantec recommends the following measures to reduce risk of attack: