Symantec Fixes Privilege Escalation Flaw in Endpoint Protection

mood · Nov 14, 2019

Symantec Fixes Privilege Escalation Flaw in Endpoint Protection
November 14, 2019
https://www.bleepingcomputer.com/ne...ilege-escalation-flaw-in-endpoint-protection/

Symantec fixed a local privilege escalation security flaw affecting all Symantec Endpoint Protection software versions prior to 14.2 RU2, and allowing attackers to escalate privileges on compromised devices and execute malicious code using SYSTEM privileges.
Privilege escalation flaw fixed by Symantec
The Symantec Endpoint Protection LPE bug now tracked as CVE-2019-12758 requires potential attackers to have Administrator privileges to successfully exploit the issue to Hadar.

Upon successful exploitation, it can be used "to bypass Symantec’s Self-Defense mechanism and achieve defense evasion, persistence and privilege escalation by loading an arbitrary unsigned DLL into a process that is signed by Symantec and that runs as NT AUTHORITY\SYSTEM.," Hadar says.
Symantec addressed the LPE vulnerability in the Symantec Endpoint Protection 14.2 RU2 release issued on October 22, 2019.
Arbitrary unsigned DLL loading from CWD
Hadar says that CVE-2019-12758 is caused by the security solution's attempt to load a DLL from its current working directory (CWD) instead of the DLL's actual location and by not validating if the DLLs is signed with a digital certificate.
Click to expand...

SafeBreach: Symantec Endpoint Protection - Self-Defense Bypass and Potential Usages (CVE-2019-12758)

Log in or Sign up

Symantec Fixes Privilege Escalation Flaw in Endpoint Protection

mood Updates Team

Log in or Sign up

Symantec Fixes Privilege Escalation Flaw in Endpoint Protection

mood Updates Team

Useful Searches