Symantec Endpoint Protection Manager CVE-2013-5014 XML External Entity Injection Vulnerability

Bugtraq ID:	65466
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-5014
Remote:	Yes
Local:	No
Published:	Feb 13 2014 12:00AM
Updated:	Feb 26 2014 01:31PM
Credit:	SEC Consult
Vulnerable:
Not Vulnerable:

Symantec Endpoint Protection Manager CVE-2013-5014 XML External Entity Injection Vulnerability

Symantec Endpoint Protection Manager is prone to XML External Entity injection vulnerability.

Successfully exploiting this issue may allow an attacker to gain unauthorized access; this may aid in further attacks.

The following versions are vulnerable:

Symantec Endpoint Protection Manager 11.0
Symantec Endpoint Protection Center Small Business Edition 12.0
Symantec Endpoint Protection Manager 12.1

Symantec Endpoint Protection Manager CVE-2013-5014 XML External Entity Injection Vulnerability

The following exploits are available:

• /data/vulnerabilities/exploits/65466.py
• /data/vulnerabilities/exploits/65466.rb

Symantec Endpoint Protection Manager CVE-2013-5014 XML External Entity Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Symantec Endpoint Protection Manager CVE-2013-5014 XML External Entity Injection Vulnerability

References:

• Symantec Homepage (Symantec Corp.)