====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN009
_____________________________________________________________________

DATE                : 14/01/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Symantec Endpoint Detection and
                        Response versions prior to 4.3.0.

=====================================================================
http://support.symantec.com/us/en/article.SYMSA1502.html
_____________________________________________________________________

Symantec Endpoint Detection and Response XSS

SYMSA1502
Last Updated January 13, 2020
Initial Publication Date January 06, 2020

  o Status: Closed
  o Severity: Medium
  o CVSS Base Score: 4.7

Summary:

Affected Products
+----------------------------------------------------+
|Symantec Endpoint Detection and Response (SEDR)     |
+---------------+-------------------+----------------+
|CVE            |Affected Version(s)|Remediation     |
+---------------+-------------------+----------------+
|CVE-2019-19547 |Prior to 4.3.0     |Upgrade to 4.3.0|
+---------------+-------------------+----------------+

Issues:

+-----------------------------------------------------------------------------+
|CVE-2019-19547
     |
+------------+----------------------------------------------------------------+
|Severity/   |Medium / 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

|CVSSv3:     |                                                         |
+------------+----------------------------------------------------------------+
|References: |Security Focus: BID 111367 / NVD: CVE-2019-19547         |
|            |                                                         |
|Impact:     |XSS                                                      |
+------------+----------------------------------------------------------------+
|            |Symantec Endpoint Detection and Response (SEDR), prior to
                                     4.3.0,|
|            |may be susceptible to a cross site scripting (XSS) issue.
                                     XSS is|
|Description:|a type of issue that can enable attackers to inject
                                  client-side |
|            |scripts into web pages viewed by other users. An XSS     |
|            |vulnerability may be used by attackers to potentially
                                  bypass    |
|            |access controls such as the same-origin policy.          |
+------------+----------------------------------------------------------------+

Mitigation

A Symantec Endpoint Detection and Response (SEDR) update, version 4.3.0
has been made available that addresses the listed issue. Note that the
latest Symantec Endpoint Detection and Response releases and patches are
available to customers through normal support channels.

Symantec has also created additional detections and protections which
are in place and is continuing to monitor any attempts of this exploit
against our products. At this time, there is no evidence of any attempts
at this exploit in the wild.

Symantec recommends the following measures to reduce risk of attack:

  o Restrict access to administrative or management systems to
    authorized privileged users.
  o Restrict remote access to trusted/authorized systems only.
  o Run under the principle of least privilege, where possible, to limit
    the impact of potential exploit.
  o Keep all operating systems and applications current with vendor
    patches.
  o Follow a multi-layered approach to security. At a minimum, run both
    firewall and anti-malware applications to provide multiple points of
    detection and protection for both inbound and outbound threats.
  o Deploy network and host-based intrusion detection systems to monitor
    network traffic for signs of anomalous or suspicious activity. This
    may aid in the detection of attacks or malicious activity related to
    the exploitation of latent vulnerabilities.

Acknowledgements:

  o CVE-2019-19547: Bencherchali Nasreddine | <www.elit.dz>

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================