Symantec On-Demand Protection Encrypted Data Information Disclosure Vulnerability

Bugtraq ID:	19248
Class:	Design Error
CVE:	CVE-2006-3457
Remote:	No
Local:	Yes
Published:	Jul 31 2006 12:00AM
Updated:	Aug 02 2006 05:06PM
Credit:	Symantec disclosed this issue.
Vulnerable:	Symantec On-Demand Protection (SODP) 2.6 build 2232 Symantec On-Demand Agent (SODA) 2.5 MR2 (build 2156)
Not Vulnerable:	Symantec On-Demand Protection (SODP) 2.6 build 2233 Symantec On-Demand Agent (SODA) 2.5 MR2 (build 2157)

Symantec On-Demand Protection Encrypted Data Information Disclosure Vulnerability

Symantec On-Demand Protection (SODP) and On-Demand Agent (SODA) are prone to a vulnerability that could disclose potentially sensitive information.

An attacker may be able to decrypt the files saved by the applications. The impact of this issue will depend on the information disclosed.

This issue affects:

- SODA versions 2.5 MR2 (build 2156) and earlier
- SODP versions 2.6 (build 2232) and earlier.

Note that this issue affects only the Microsoft Windows versions of the applications.

Symantec On-Demand Protection Encrypted Data Information Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Symantec On-Demand Protection Encrypted Data Information Disclosure Vulnerability

Solution:
Symantec has released updates to address this issue. Please see the referenced advisory for details.

Symantec On-Demand Protection Encrypted Data Information Disclosure Vulnerability

References:

• Symantec On-Demand Protection Solution (Symantec)