Vulnerabilities > CVE-2014-1644 - Credentials Management vulnerability in Symantec Liveupdate Administrator

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
symantec
CWE-255
nessus
NVD
Published: 2014-03-29
Updated: 2014-03-31

Summary

The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.

Vulnerable Configurations

Part Description Count
Application
Symantec
11

Common Weakness Enumeration (CWE)

Nessus

NASL familyCGI abuses
NASL idSYMANTEC_LUA_2_3_2_110.NASL
descriptionThe version of Symantec LiveUpdate Administrator 2.x hosted on the remote web server is prior to 2.3.2.110 (2.3.2.1). It is, therefore, affected by the following vulnerabilities : - A flaw exists with the forgotten password functionality where the password for an authorized user account can be forcefully reset. This could allow a remote attacker with knowledge of the account
last seen2020-06-01
modified2020-06-02
plugin id73275
published2014-03-31
reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/73275
titleSymantec LiveUpdate Administrator < 2.3.2.110 Multiple Vulnerabilities (SYM14-005)

Seebug

bulletinFamilyexploit
descriptionBugtraq ID:66399 CVE ID:CVE-2014-1644 Symantec LiveUpdate Administrator是一款Symantec产品升级管理程序。 Symantec LiveUpdate Administrator管理GUI对登录/密码功能提供不正确的保护，允许攻击者在知道目标用户email地址的情况下，利用重置密码功能重置用户密码，未授权进行访问。 0 Symantec LiveUpdate Administrator 2.x Symantec LiveUpdate Administrator 2.3.2.110已经修复该漏洞，建议用户下载更新： http://www.symantec.com/business/support/index?page=content&amp;id=TECH134809
idSSV:62001
last seen2017-11-19
modified2014-03-31
published2014-03-31
reporterRoot
titleSymantec LiveUpdate Administrator未授权访问漏洞

References