DonnaB
Premium
join:2003-05-07
malaysia
| Vulnerability with Symantec LiveUpdate 2.7 Build 3
SYM05-013
September 02, 2005
Local LiveUpdate server username / password information revealed by client
Discovery Date: August 31, 2005 - Bugtraq posting (Vulnerability in Symantec Anti Virus Corporate Edition v9.x)
Revision History: None
Risk Impact: Medium
Remote Access Yes
Local Access Yes
Authentication Required Yes
Exploit publicly available No
Details
LiveUpdate server login name and password are written to a local log file in clear text. This happens when the LiveUpdate client checks for updates from the server. This is only an issue when a local LiveUpdate server is used with a login name and password.
The login name and password belong to the account configured by the LiveUpdate server administrator for accessing LiveUpdate packages. Symantec strongly recommends that this user account be unique for accessing LiveUpdate packages only, and have no other system access. The system administrator account should never be used for this purpose.
Note: As stated in the LiveUpdate download readme file: LiveUpdate version 2.7.x does not support the LiveUpdate Administration Utility, Version 1.5.x. If you are running a system as a Central LiveUpdate server please go to »www.symantec.com/techsupp/files/lu/lu.html and download Version 1.5.4.15 update for the LiveUpdate Administration Utility.
Affected Products
Product Version Build Solution
LiveUpdate Client 2.7 34 LiveUpdate Client Update
Non-Affected Products
Product Version Build
LiveUpdate Client 2.5 All
LiveUpdate Client 2.6 All
Symantec Response
An update for the LiveUpdate 2.7 client has been released and can be downloaded from the following location:
»www.symantec.com/techsupp/files/lu/lu.html
Symantec is not aware of any active attempts against or organizations impacted by this issue.
As a part of normal best practices, users should keep vendor-supplied patches for all application software and operating systems up-to-date. Symantec strongly recommends any affected customers update their product immediately to protect against these types of threats
»securityresponse.symantec.com/av···.02.html
--
Microsoft MVP-Windows SecurityMember of ASAPCalendar of UpdatesSecurityFlash |
|
NICK ADSL UK
Premium,MVM
join:2004-02-22 | Thank you Donna  |
|
amysheehan
Premium,VIP,MVM
join:1999-12-21
Huntington Beach, CA
 ·RoadRunner Cable
2 edits |  reply to DonnaB
after updating |
Note: The affected version is
v2.7.34
v2.7.38.0 is the updated version released 02 Sept
[see screenshot after update]
 |
|
DonnaB
Premium
join:2003-05-07
malaysia | reply to DonnaB
You're welcome Nick and amysheehan.
BTW, a reboot is required after installing the new version of LU. |
|
