Symantec Endpoint Encryption Privilege Escalation
SUMMARY
Symantec has released an update to address issues that were discovered in the Symantec Endpoint Encryption and Symantec Encryption Desktop products.
AFFECTED PRODUCTS
|
Symantec Endpoint Encryption (SEE) |
||
|
CVE |
Affected Version(s) |
Remediation |
|
CVE-2019-9702 CVE-2019-9703 |
Prior to SEE 11.3.0 |
Upgrade to SEE 11.3.0 |
|
Symantec Encryption Desktop (SED) |
||
|
CVE |
Affected Version(s) |
Remediation |
|
CVE-2019-9702 CVE-2019-9703 |
All versions |
Migrate to SEE 11.3.0 (See above) |
ISSUES
|
CVE-2019-9702 |
|
|
Severity/CVSSv3: |
Medium / 6.5 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H |
|
References: Impact: |
Security Focus: BID 108795 / NVD: CVE-2019-9702 Privilege Escalation |
|
Description: |
Symantec Endpoint Encryption and Symantec Encryption Desktop may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. |
|
CVE-2019-9703 |
|
|
Severity/CVSSv3: |
Medium / 6.5 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H |
|
References: Impact: |
Security Focus: BID 108796 / NVD: CVE-2019-9703 Privilege Escalation |
|
Description: |
Symantec Endpoint Encryption and Symantec Encryption Desktop may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. |
MITIGATION
These issues were validated by the product team engineers. A Symantec Endpoint Encryption update version SEE 11.3.0, has been released which addresses the aforementioned issues. Note that SEE Bitlocker is not affected by this report.
The latest releases and patches for Symantec Endpoint Encryption are available to customers through normal support channels. At this time, Symantec is not aware of any exploitations or adverse customer impact from these issues.
Note for users of Symantec Encryption Desktop, the following two options exist for install/upgrade scenarios for Symantec Encryption Desktop to avoid this report completely:
Option 1: If Drive Encryption is not being used for Symantec Encryption Desktop, but other components are still being used, a customized install can be performed to disable the affected Drive Encryption driver with the following install option:
msiexec /i SymantecEncryptionDesktop.msi PGP_INSTALL_WDE=0
This will not install the Drive Encryption component, but will install all other encryption components such as File Share, PGPzip and Email Encryption.
(See article TECH249430 for more information on msiexec option)
Option 2: If Symantec Endpoint Encryption 11.3 can be installed over the top of Symantec Encryption Desktop for the Drive Encryption component the affected SED driver will be replaced with the patched SEE 11.3 driver for Drive Encryption. All other components such as File Share Encryption or Email Encryption will remain installed even after SEE has been installed over SED to replace the Drive Encryption component.
Be advised, If the above two options are not possible for Symantec Encryption Desktop, Symantec still recommends the following measures to reduce risk of attack:
- Restrict access to administrative or management systems to authorized privileged users.
- Restrict remote access to trusted/authorized systems only.
- Run under the principle of least privilege, where possible, to limit the impact of potential exploit.
- Keep all operating systems and applications current with vendor patches.
- Follow a multi-layered approach to security. At a minimum, run both firewall and anti-malware applications to provide multiple points of detection and protection for both inbound and outbound threats.
- Deploy network and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in the detection of attacks or malicious activity related to the exploitation of latent vulnerabilities.
ACKNOWLEDGEMENTS
- CVE-2019-9702: Kyriakos Economou (@kyREcon) of Nettitude: https://www.nettitude.com/
- CVE-2019-9703: Kyriakos Economou (@kyREcon) of Nettitude: https://www.nettitude.com/