SUMMARY

Symantec’s Encryption Desktop for OS X installs some temporary files with world-writable attributes during installation.  In a multi-user environment, a malicious user could manipulate these world-writable files to read and write files or create files with another user’s permissions.

AFFECTED PRODUCTS

ISSUES

MITIGATION

Details

Symantec was notified of Symantec Encryption Desktop for OS X installing temporary files with world-writeable permissions.  In a multi-user environment, a malicious user could manipulate these weak file permissions to create new files or change permissions on an existing file with another user’s permissions whenever the targeted user accesses Symantec Encryption Desktop.  This could potentially allow an authorized but non-privileged user to gain unauthorized access to or create arbitrary files with another system user’s potentially privileged access.

Symantec Response

Symantec engineers verified these finding and have released an update in Symantec Encryption Desktop 10.3.2 maintenance pack 2 for OS X addressing the issue.

Update information

Customers may obtain Symantec Desktop Encryption maintenance updates through their normal Symantec support locations.

Best Practices

As part of normal best practices, Symantec strongly recommends:

• Restrict access to administration or management systems to privileged users.
• Disable remote access if not required or restrict it to trusted/authorized systems only.
• Where possible, limit exposure of application and web interfaces to trusted/internal networks only.
• Keep all operating systems and applications updated with the latest vendor patches.
• Follow a multi-layered approach to security. Run both firewall and anti-malware applications, at a minimum, to provide multiple points of detection and protection to both inbound and outbound threats.
• Deploy network and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in detection of attacks or malicious activity related to exploitation of latent vulnerabilities

ACKNOWLEDGEMENTS

Symantec would like to thank Aaron Sigel for reporting this and working with Symantec as we addressed it.

REFERENCES

BID: Security Focus, http://www.securityfocus.com, has assigned a Bugtraq ID (BID) to this issue for inclusion in the Security Focus vulnerability database.

CVE: This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.