Linux Kernel Aug 2017 - Sep 2018 Vulnerabilities
SUMMARY
Symantec Network Protection products that include a vulnerable version of the Linux kernel are susceptible to multiple vulnerabilities. A remote attacker, with access to the management interface, can obtain unauthorized read/write access to local files, cause denial of service, and possible execute arbitrary code.
AFFECTED PRODUCTS
| Advanced Secure Gateway (ASG) | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5390 | 6.6 | Upgrade to later release with fixes. |
| 6.7 | Upgrade to 6.7.4.8. | |
| 7.1 | Upgrade to later release with fixes. | |
| 7.2 | Not vulnerable, fixed | |
| Content Analysis (CA) | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5391 | 1.3, 2.1, 2.2, 2.3 | Upgrade to later version with fixes. |
| 2.4, 3.0 | Not available at this time | |
| 3.1 | Not vulnerable, fixed in 3.1.0.0. | |
| Director | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2017-18017, CVE-2018-5390, CVE-2018-5391 |
6.1 | Upgrade to a version of MC with the fixes. |
| Malware Analysis (MA) | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5390, CVE-2018-5391 | 4.2 | Upgrade to a version of Content Analysis with fixes. |
| Mail Threat Defense (MTD) | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5391 | 1.1 | Upgrade to a version of CAS and SMG with the fixes. |
| Management Center (MC) | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5391 | 2.0 - 2.4 | Upgrade to later release with fixes. |
| 3.0 and later | Not vulnerable, fixed in 3.0.1.1 | |
| PacketShaper (PS) S-Series | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5390, CVE-2018-5391 | 11.6, 11.9, 11.10 | A fix will not be provided. Allot Secure Services Gateway (SSG) is a replacement product for PS S-Series. Switch to a version of SSG with the vulnerability fixes. |
| PolicyCenter (PC) S-Series | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5390, CVE-2018-5391 | 1.1 | A fix will not be provided. Allot NetXplorer is a replacement product for PC S-Series. Switch to a version of NetXplorer with the vulnerability fixes. |
| ProxySG | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5390 | 6.5, 6.6 | Upgrade to later release with fixes. |
| 6.7 | Upgrade to 6.7.4.8. | |
| 7.1 | Upgrade to later release with fixes. | |
| 7.2 | Not vulnerable, fixed in 7.2.0.1. | |
| Reporter | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5391 | 9.5 | Not vulnerable |
| 10.1, 10.2, 10.3, 10.4 | Upgrade to later release with fixes. | |
| 10.5 | Not vulnerable, fixed in 10.5.1.1. | |
| Security Analytics | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5390, CVE-2018-5391 | 7.2, 7.3, 8.0 | Upgrade to later release with fixes. |
| 8.1 | Not vulnerable, fixed in 8.1.1. | |
| SSL Visibility (SSLV) | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5390 | 3.10, 3.11, 3.12, 5.0 | Upgrade to later release with fixes. |
| 4.2, 4.3, 4.4 | Not vulnerable | |
| 4.5 | Not available at this time | |
| 5.2 | Not vulnerable, fixed in 5.2.1.1. | |
| CVE-2018-5391 | 3.10, 3.11, 3.12, 4.2, 4.3, 4.4, 5.0 | Upgrade to later release with fixes. |
| 4.5 | Not available at this time | |
| 5.2 | Not vulnerable, fixed in 5.2.1.1. | |
| X-Series XOS | ||
|---|---|---|
| CVE | Supported Version(s) | Remediation |
| CVE-2018-5390, CVE-2018-5391 | 10.0, 11.0 | A fix will not be provided. |
ADDITIONAL PRODUCT INFORMATION
The following products are not vulnerable:
AuthConnector
BCAAA
CacheFlow
Cloud Data Protection for ServiceNow
Cloud Data Protection for Oracle CRM On Demand
Cloud Data Protection Integration Server
Cloud Data Protection Communication Server
General Auth Connector Login Application
HSM Agent for the Luna SP
IntelligenceCenter
IntelligenceCenter Data Collector
PacketShaper
PolicyCenter
ProxyAV
ProxyAV ConLog and ConLogXP
Unified Agent
Web Isolation
WSS Mobile Agent
ISSUES
| CVE-2017-13715 | |
|---|---|
| Severity / CVSSv3 | Critical / 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| References | SecurityFocus: BID 100517 / NVD: CVE-2017-13715 |
| Impact | Denial of service, code execution |
| Description | A flaw in internal state initialization allows a remote attacker to send a crafted MPLS packet and cause denial of source through a system crash, or possibly execute arbitrary code. |
| CVE-2017-1000251 | |
|---|---|
| Severity / CVSSv3 | High / 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| References | SecurityFocus: BID 100809 / NVD: CVE-2017-1000251 |
| Impact | Code execution |
| Description | A flaw in L2CAP configuration responses in the native Bluetooth stack allows a remote attacker to send crafted responses and execute arbitrary code. |
| CVE-2017-18017 | |
|---|---|
| Severity / CVSSv3 | Critical / 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| References | SecurityFocus: BID 102367 / NVD: CVE-2017-18017 |
| Impact | Denial of service |
| Description | A flaw in TCPMSS firewall target processing allows a remote attacker to send crafted packets and cause denial of service or unspecified other impact. |
| CVE-2018-5390 (SegmentSmack) | |
|---|---|
| Severity / CVSSv3 | High / 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) |
| References | SecurityFocus: BID 104976 / NVD: CVE-2018-5390 |
| Impact | Denial of service |
| Description | A flaw in TCP fragment reassembly allows a remote attacker to send crafted TCP fragments and cause denial of service through CPU exhaustion. |
| CVE-2018-5391 (FragmentSmack) | |
|---|---|
| Severity / CVSSv3 | High / 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) |
| References | SecurityFocus: BID 105108 / NVD: CVE-2018-5391 |
| Impact | Denial of service |
| Description | A flaw in IP fragment reassembly allows a remote attacker to send crafted IP fragments and cause denial of service. |
| CVE-2018-5703 | |
|---|---|
| Severity / CVSSv3 | Critical / 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| References | NVD: CVE-2018-5703 |
| Impact | Denial of service |
| Description | A flaw in the TLS implementation allows a remote attacker to send crafted packets and cause a system crash, resulting in denial of service. |
| CVE-2018-1000028 | |
|---|---|
| Severity / CVSSv3 | High / 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) |
| References | NVD: CVE-2018-1000028 |
| Impact | Security control bypass |
| Description | A flaw in NFS access control allows a remote attacker to get unauthorized read/write access to local files. |
| CVE-2018-10938 | |
|---|---|
| Severity / CVSSv3 | Medium / 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) |
| References | SecurityFocus: BID 105154 / NVD: CVE-2018-10938 |
| Impact | Denial of service |
| Description | A flaw in packet handling allows a remote attacker to send crafted packets and cause denial of service through an infinite loop. |
| CVE-2018-14641 | |
|---|---|
| Severity / CVSSv3 | Medium / 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) |
| References | NVD: CVE-2018-14641 |
| Impact | Denial of service |
| Description | A flaw in IP fragment reassembly allows a remote attacker to send crafted IP fragments and cause denial of service. |
REVISION
2021-07-20 A fix for SSLV 4.4 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2021-07-15 A fix for Security Analytics 7.2 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2021-06-07 A fix for SSLV 3.10, SSLV 3.12, and SSLV 5.0 will not be provided. Please upgrade to a later version with the vulnerability fixes. SSLV 5.2 is not vulnerable because a fix is available in 5.2.1.1.
2021-02-18 A fix for CA 2.3 and MC 2.4 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2020-11-30 MC 3.0 is not vulnerable because a fix is available in 3.0.1.1.
2020-11-19 A fix for MTD 1.1 will not be provided. Please upgrade to a version of CAS and SMG with the vulnerability fixes. A fix for SA 7.3 and 8.0 will not be provided. Please upgrade to a later version with the vulnerability fixes. A fix for XOS 9.7, 10.0, and 11.0 will not be provided. A fix for Director 6.1 will not be provided. Please upgrade to a version of MC with the vulnerability fixes. A fix for Reporter 10.4 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2020-11-12 Content Analysis 3.1 is not vulnerable because a fix is available in 3.1.0.0.
2020-08-19 A fix for MC 2.3 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2020-04-30 A fix will not be provided for ProxySG 6.5. Please upgrade to a later version with the vulnerability fixes.
2020-04-08 Content Analysis 3.0 is vulnerable to CVE-2018-5391. Reporter 10.5 is not vulnerable because a fix is available in 10.5.1.1. Security Analytics 8.1 is not vulnerable because a fix is available in 8.1.1. Fixes will not be provided for Management Center 2.2 and Reporter 10.3. Please upgrade to later versions with the vulnerability fixes.
2020-04-04 A fix for PacketShaper S-Series will not be provided. Allot Secure Services Gateway (SSG) is a replacement product for PacketShaper S-Series. Switch to a version of SSG with the vulnerability fixes. A fix for PolicyCenter S-Series will not be provided. Allot NetXplorer is a replacement product for PolicyCenter S-Series. Switch to a version of NetXplorer with the vulnerability fixes.
2020-01-28 A fix will not be provided for ASG 7.1 and ProxySG 7.1. Please upgrade to a later version with the vulnerability fix. ASG and ProxySG 7.2 are not vulnerable because fixes are available in 7.2.0.1 EA.
2020-01-19 A fix will not be provided for Malware Analysis. Please upgrade to a version of Content Analysis with the vulnerability fixes. PacketShaper and ProxyAV are not vulnerable.
2019-10-02 Web Isolation is not vulnerable.
2019-09-05 A fix for MC 2.1 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2019-08-30 Reporter 10.4 is vulnerable to CVE-2018-5390 and CVE-2018-5391.
2019-08-19 CA, MTD, MC, Reporter 10.x, and SSLV 4.2-4.4 are not vulnerable to CVE-2018-5390. SSLV 3.12 and 4.5 are vulnerable to CVE-2018-5390 and CVE-2018-5391. CA 2.4 is vulnerable to CVE-2018-5391.
2019-08-13 MC 2.2 and MC 2.3 are vulnerable to CVE-2018-5390 and CVE-2018-5391. A fix for MC 2.0 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2019-08-07 A fix for ASG 6.6 and ProxySG 6.6 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2019-08-06 A fix for Reporter 10.1 and 10.2 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2019-08-06 A fix for SSLV 4.3 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2019-07-25 It was previously reported that a fix for CVE-2018-5390 in ASG 6.7 is available in 6.7.4.141 EA. Further investigation has shown that ASG 6.7.4.141 EA is still vulnerable. A fix for CVE-2018-5390 in ASG 6.7 and ProxySG 6.7 is available in 6.7.4.8. ASG and ProxySG are not vulnerable to CVE-2018-5391.
2019-02-04 A fix for CA 1.3 and CA 2.2 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2019-01-18 SSLV 5.0 is vulnerable to CVE-2018-5390 and CVE-2018-5391. A fix for SSLV 3.11 and 4.2 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2019-01-14 Reporter 10.3 is vulnerable to CVE-2018-5390 and CVE-2018-5391.
2019-01-13 SSLV 3.x and 4.x are vulnerable to CVE-2018-5390 and CVE-2018-5391. A fix is not available at this time.
2019-01-11 A fix for CA 2.1 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2018-11-28 initial public release