CVEvulnerability

CVE-2007-2375

10.0 HIGH Published 2007-04-30 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2007-04-30
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol.

Affected configurations

• symantec enterprise security manager 5.5.3 • symantec enterprise security manager 6.0 • symantec enterprise security manager 6.5 • symantec enterprise security manager 6.5.1 • symantec enterprise security manager 6.5.2

References

http://secunia.com/advisories/24767 Patch, Vendor Advisory
http://www.securityfocus.com/bid/23287 www.securityfocus.com
http://www.securitytracker.com/id?1017881 www.securitytracker.com
http://www.symantec.com/avcenter/security/Content/2007.04.05d.html Vendor Advisory
http://www.vupen.com/english/advisories/2007/1277 www.vupen.com
http://secunia.com/advisories/24767 Patch, Vendor Advisory
http://www.securityfocus.com/bid/23287 www.securityfocus.com
http://www.securitytracker.com/id?1017881 www.securitytracker.com
http://www.symantec.com/avcenter/security/Content/2007.04.05d.html Vendor Advisory
http://www.vupen.com/english/advisories/2007/1277 www.vupen.com