Symantec Brightmail Gateway Control Center Remote Privilege Escalation Vulnerability

Bugtraq ID:	34639
Class:	Input Validation Error
CVE:	CVE-2009-0064
Remote:	Yes
Local:	No
Published:	Apr 23 2009 12:00AM
Updated:	Apr 30 2009 06:46PM
Credit:	Dr. Marian Ventuneac, Perot Systems
Vulnerable:	Symantec Mail Security 8300 Series Appliance 0 Symantec Mail Security 8200 Series Appliance Symantec Brightmail Gateway 8300 Series Appliance 0 Symantec BrightMail Appliance 8.0 Symantec BrightMail Appliance 5.0
Not Vulnerable:	Symantec BrightMail Appliance 8.0.1

Symantec Brightmail Gateway Control Center Remote Privilege Escalation Vulnerability

Symantec Brightmail Gateway is prone to a remote privilege-escalation vulnerability.

Remote authorized attackers who have access to the targeted host's local network can exploit this issue to gain elevated access. Successful exploits may compromise the affected computer and may aid in other attacks.

Versions prior to Brightmail Gateway 8.0.1 are vulnerable.

Symantec Brightmail Gateway Control Center Remote Privilege Escalation Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symantec Brightmail Gateway Control Center Remote Privilege Escalation Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for more information.

Symantec Brightmail Gateway Control Center Remote Privilege Escalation Vulnerability

References:

• Brightmail Homepage (Symantec)
  
• SYM09-005 - Symantec Brightmail Gateway Appliance Cross-site Scripting and Eleva (Symantec)