Symantec Clientless VPN Gateway 4400 Series Multiple Vulnerabilities

Bugtraq ID:	10903
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Aug 06 2004 12:00AM
Updated:	Aug 06 2004 12:00AM
Credit:	These issues were announced by Symantec.
Vulnerable:	Symantec Clientless VPN Gateway 4400 Series 5.0
Not Vulnerable:

Symantec Clientless VPN Gateway 4400 Series Multiple Vulnerabilities

Multiple vulnerabilities have been addressed in Symantec Clientless VPN Gateway 4400 Series.

The issues include multiple vulnerabilities related to the ActiveX and HTML file browser, cross-site scripting vulnerabilities in the end user interface, and a vulnerability in the end user interface that will allow an unauthorized user to change another user's single signon information.

Symantec Clientless VPN Gateway 4400 Series Multiple Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Symantec Clientless VPN Gateway 4400 Series Multiple Vulnerabilities

Solution:
A hotfix has been released to address these issues. Please see the attached Hotfix: SCVG5-20040806-00 advisory for further information on how to apply the fix.


Symantec Clientless VPN Gateway 4400 Series 5.0

• Symantec SCVG5-20040806-00.tgz
  ftp://ftp.symantec.com/public/english_us_canada/products/sym_clientles s_vpn/sym_clientless_vpn_5/updates/SCVG5-20040806-00.tgz

Symantec Clientless VPN Gateway 4400 Series Multiple Vulnerabilities

References:

• Hotfix: SCVG5-20040806-00 (Symantec)
  
• Symantec Clientless VPN Gateway 4400 Series Homepage (Symantec)