full-disclosure - Re: ZDI-12-145 : Symantec Endpoint Protection SemSvc.exe AgentServlet Remote Code Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3998da235410a7ccc4ce7ea278bb6b50@localhost>
Date: Wed, 22 Aug 2012 09:58:32 -0600
From: James Lay <jlay@...ve-tothe-box.net>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Re: ZDI-12-145 : Symantec Endpoint Protection
	SemSvc.exe AgentServlet Remote Code Execution Vulnerability

On 2012-08-22 09:40, ZDI Disclosures wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> ZDI-12-145 : Symantec Endpoint Protection SemSvc.exe AgentServlet 
> Remote
> Code Execution Vulnerability
> http://www.zerodayinitiative.com/advisories/ZDI-12-145
> August 22, 2012
<snip>
> - -- Vendor Response:
> Symantec has issued an update to correct this vulnerability. More 
> details
> can be found at:
> 
> http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se
> curity_advisory&pvid=security_advisory&year=2012&suid=20120522_01
>
> - -- Disclosure Timeline:
> 2011-10-28 - Vulnerability reported to vendor
> 2012-08-22 - Coordinated public release of advisory
>
<more snipped>

According to the link, they published a fix in May of this year?  Did I 
miss something?  Thanks.

James

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/