Menu
Symantec patches privilege escalation flaws in Endpoint Protection

Symantec patches privilege escalation flaws in Endpoint Protection

Exploit code for the flaws was released Tuesday

Symantec has released a patch for privilege escalation flaws in its Endpoint Protection product, and the company which found the issues released the exploit code on Tuesday.

The flaws, found by Offensive Security, affects Symantec Endpoint Protection client versions 11 and 12.1 and Symantec Endpoint Protection 12.0 Small Business Edition, according to an advisory.

Administrators will need to download the fix, called "Symantec Endpoint Protection 12.1 Release Update 4 Maintenance Patch 1b (RU4 MP1b)," from the company's FileConnect service. It upgrades Endpoint Protection clients to version 12.1.4112.4156.

The flaws were contained in the Application and Device Control driver. If exploited, the vulnerabilities could allow a person who is already logged on to gain higher access on a network and potentially system access. Offensive Security said it would then be possible for an attacker to dump password hashes or identify the cache credentials of domain administrators.

The security company found the vulnerability during a penetration test of a financial services company. Trainers with the company were due to give an overview including proof-of-concept code during a session at the Black Hat security conference in Las Vegas this week.

Exploit code was posted online on Tuesday after Symantec released the patches.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchessymantecsecurityOffensive SecurityExploits / vulnerabilities

Featured

Slideshows

Sizing up the NZ security spectrum - Where's the channel sweet spot?

Sizing up the NZ security spectrum - Where's the channel sweet spot?

From new extortion schemes, outside threats and rising cyber attacks, the art of securing the enterprise has seldom been so complex or challenging. With distance no longer a viable defence, Kiwi businesses are fighting to stay ahead of the security curve. In total, 28 per cent of local businesses faced a cyber attack last year, with the number in New Zealand set to rise in 2017. Yet amidst the sensationalism, media headlines and ongoing high profile breaches, confusion floods the channel, as partners seek strategic methods to combat rising sophistication from attackers. In sizing up the security spectrum, this Reseller News roundtable - in association with F5 Networks, Kaspersky Lab, Tech Data, Sophos and SonicWall - assessed where the channel sweet spot is within the New Zealand channel. Photos by Maria Stefina.

Sizing up the NZ security spectrum - Where's the channel sweet spot?
Kiwi channel comes together for another round of After Hours

Kiwi channel comes together for another round of After Hours

The channel came together for another round of After Hours, with a bumper crowd of distributors, vendors and partners descending on The Jefferson in Auckland. Photos by Maria Stefina.​

Kiwi channel comes together for another round of After Hours
Consegna comes to town with AWS cloud offerings launch in Auckland

Consegna comes to town with AWS cloud offerings launch in Auckland

Emerging start-up Consegna has officially launched its cloud offerings in the New Zealand market, through a kick-off event held at Seafarers Building in Auckland.​ Founded in June 2016, the Auckland-based business is backed by AWS and supported by a global team of cloud specialists, leveraging global managed services partnerships with Rackspace locally.

Consegna comes to town with AWS cloud offerings launch in Auckland
Show Comments