Symantec Workspace Streaming XMLRPC Unauthorized Access Vulnerability

Bugtraq ID:	67189
Class:	Design Error
CVE:	CVE-2014-1649
Remote:	Yes
Local:	No
Published:	May 12 2014 12:00AM
Updated:	Aug 27 2014 02:43AM
Credit:	Andrea Micalizzi (rgod) working through HP�??s Zero Day Initiative(ZDI)
Vulnerable:	Symantec Workspace Streaming 6.1 SP4 Symantec Workspace Streaming 6.1
Not Vulnerable:

Symantec Workspace Streaming XMLRPC Unauthorized Access Vulnerability

Symantec Workspace Streaming is prone to an unauthorized-access vulnerability.

Successful exploits will allow attackers to create a back door on the targeted server, resulting in unauthorized privileged access.

Symantec Workspace Streaming 7.5.x and prior are vulnerable.

Symantec Workspace Streaming XMLRPC Unauthorized Access Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit is available:

• /data/vulnerabilities/exploits/67189.rb

Symantec Workspace Streaming XMLRPC Unauthorized Access Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Symantec Workspace Streaming XMLRPC Unauthorized Access Vulnerability

References:

• Symantec Workspace Streaming Homepage (Symantec)