Symantec Encryption Desktop memory block data access damage Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
Symantec Encryption Desktop 10.0.x-10.2.x
Symantec Encryption Desktop Professional <10.3.2 MP1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 67020
CVE (CAN) ID: CVE-2014-1647
 
Symantec Encryption Desktop is a multi-layer storage Encryption solution. By binding Drive Encryption to ensure the security of local hard Drive files, you can use File Share Encryption to ensure the security of File sharing in the cloud.
 
Symantec PGP Desktop 10.0.x-10.2.x and Encryption Desktop Professional 10.3.2 MP1 versions do not correctly move block data, this allows remote attackers to cause denial of service (read access corruption and application crash) through malformed certificates ).
 
<* Source: Jeremy Brown
*>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:
 
If you cannot install or upgrade the patch immediately, NSFOCUS recommends that you take the following measures to reduce the threat:
 
* Restrict access to administrators or management systems.
* Disable or restrict remote access
* Do not expose applications and Web interfaces whenever possible.
* Upgrade to the latest version.
* Deploy a host to intrude into the system.
 
Vendor patch:
 
Symantec
--------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://www.symantec.com/business/security_response/
Http://www.symantec.com/security_response/securityupdates/detail.jsp? Fid = security_advisory & pvid = security_advisory & year = & suid = 20140423_00