Symantec Norton Core CVE-2018-5234 Local Command Injection Vulnerability

Bugtraq ID:	103955
Class:	Input Validation Error
CVE:	CVE-2018-5234
Remote:	No
Local:	Yes
Published:	Apr 30 2018 12:00AM
Updated:	Apr 30 2018 12:00AM
Credit:	Alexander Rumyantsev
Vulnerable:	Symantec Norton Core v229 Symantec Norton Core v226 Symantec Norton Core v223 Symantec Norton Core v213 Symantec Norton Core v207 Symantec Norton Core v202 Symantec Norton Core v193 Symantec Norton Core v191 Symantec Norton Core v180 Symantec Norton Core v164
Not Vulnerable:	Symantec Norton Core v237

Symantec Norton Core CVE-2018-5234 Local Command Injection Vulnerability

Symantec Norton Core is prone to an unspecified local command-injection vulnerability.

An attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected host; this may aid in further attacks.

Versions prior to Norton Core v237 are vulnerable.

Symantec Norton Core CVE-2018-5234 Local Command Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symantec Norton Core CVE-2018-5234 Local Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Symantec Norton Core CVE-2018-5234 Local Command Injection Vulnerability

References:

• Symantec Home Page (Symantec)
  
• Norton Core Command Injection SYM18-002 (Symantec)
  
• Norton Core Firmware Update - Release Notes (Symantec)