Symantec patches privilege escalation flaws in Endpoint Protection

Exploit code for the flaws was posted online after Symantec released the patches

Symantec has released a patch for privilege escalation flaws in its Endpoint Protection product, and the company that found the issues released the exploit code on Tuesday.

The flaws, found by Offensive Security, affects Symantec Endpoint Protection client versions 11 and 12.1 and Symantec Endpoint Protection 12.0 Small Business Edition, according to an advisory.

[ Watch out for 11 signs you've been hacked -- and learn how to fight back. Find out how in InfoWorld's PDF special report. | Stay up to date on the latest security developments with InfoWorld's Security Central newsletter. ]

Administrators will need to download the fix, called "Symantec Endpoint Protection 12.1 Release Update 4 Maintenance Patch 1b (RU4 MP1b)," from the company's FileConnect service. It upgrades Endpoint Protection clients to version 12.1.4112.4156.

The flaws were contained in the Application and Device Control driver. If exploited, the vulnerabilities could allow a person who is already logged on to gain higher access on a network and potentially system access. Offensive Security said it would then be possible for an attacker to dump password hashes or identify the cache credentials of domain administrators.

The security company found the vulnerability during a penetration test of a financial services company. Trainers with the company were due to give an overview including proof-of-concept code during a session at the Black Hat security conference in Las Vegas this week.

Exploit code was posted online on Tuesday after Symantec released the patches.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Recommended
Join the discussion
Be the first to comment on this article. Our Commenting Policies