vendor:
Data Center Security: Server Advanced (SDCS:SA) and Symantec Critical System Protection (SCSP)
by:
Stefan Viehböck, SEC Consult Vulnerability Lab
9
CVSS
CRITICAL
Multiple vulnerabilities
N/A
CWE
Product Name: Data Center Security: Server Advanced (SDCS:SA) and Symantec Critical System Protection (SCSP)
Affected Version From: Vulnerable / tested versions
Affected Version To: Vulnerable / tested versions
Patch Exists: Yes
Related CWE: CVE-2014-7289, CVE-2014-9224, CVE-2014-9225, CVE-2014-9226
CPE: N/A
Metasploit:
N/A
Other Scripts:
https://www.infosecmatter.com/nessus-plugin-library/?id=81549, https://www.infosecmatter.com/nessus-plugin-library/?id=80911, https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/linux/local/systemtap_modprobe_options_priv_esc, https://www.infosecmatter.com/nessus-plugin-library/?id=81550, https://www.infosecmatter.com/nessus-plugin-library/?id=80911, https://www.infosecmatter.com/nessus-plugin-library/?id=131592, https://www.infosecmatter.com/nessus-plugin-library/?id=80911, https://www.infosecmatter.com/nessus-plugin-library/?id=80911, https://www.infosecmatter.com/nessus-plugin-library/?id=137966, https://www.infosecmatter.com/nessus-plugin-library/?id=131592
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2015
Multiple critical vulnerabilities
Multiple critical vulnerabilities were discovered in Symantec Data Center Security: Server Advanced (SDCS:SA) and Symantec Critical System Protection (SCSP). These vulnerabilities include CVE-2014-7289, CVE-2014-9224, CVE-2014-9225, and CVE-2014-9226. These vulnerabilities could allow an attacker to gain access to sensitive information, execute arbitrary code, and cause a denial of service. SCSP 5.2.9 MP6 and SDCS:SA 6.0 MP1 have been released to address these vulnerabilities, but not all of them have been fixed.
Mitigation:
The vendor should fix the vulnerabilities as soon as possible and provide patches for all affected versions.