« Volver al listado

CVE-2016-6590

Estado: ModificadaAlta (7.8)—

A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite 8.0 prior to 8.0 HF4 and Suite 7.6 prior to 7.6 HF7, Symantec Ghost Solution Suite 3.1 prior to 3.1 MP4, Symantec Endpoint Virtualization 7.x prior to 7.6 HF7, and Symantec Encryption Desktop 10.x prior to 10.4.1, which could let a local malicious user execute arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Symantec — Encryption DesktopSymantec — Endpoint EncryptionSymantec — Ghost Solution SuiteSymantec — IT Management Suite

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-6590",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.4,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@symantec.com",
      "affectedData": [
        {
          "vendor": "Symantec",
          "product": "IT Management Suite",
          "versions": [
            {
              "status": "affected",
              "version": "8.0 prior to 8.0 HF4 and  7.6 prior to 7.6 HF7"
            }
          ]
        },
        {
          "vendor": "Symantec",
          "product": "Ghost Solution Suite",
          "versions": [
            {
              "status": "affected",
              "version": "3.1 prior to 3.1 MP4"
            }
          ]
        },
        {
          "vendor": "Symantec",
          "product": "Symantec Endpoint Virtualization",
          "versions": [
            {
              "status": "affected",
              "version": "7.x  prior to 7.6 HF"
            }
          ]
        },
        {
          "vendor": "Symantec",
          "product": "Encryption Desktop",
          "versions": [
            {
              "status": "affected",
              "version": "0.x prior to 10.4.1"
            },
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-08T16:15:10.517",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/94279",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1037302",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "https://support.symantec.com/us/en/article.symsa1385.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94279",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1037302",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.symantec.com/us/en/article.symsa1385.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite 8.0 prior to 8.0 HF4 and Suite 7.6 prior to 7.6 HF7, Symantec Ghost Solution Suite 3.1 prior to 3.1 MP4, Symantec Endpoint Virtualization 7.x prior to 7.6 HF7, and Symantec Encryption Desktop 10.x prior to 10.4.1, which could let a local malicious user execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de escalada de privilegios cuando se cargan bibliotecas DLL durante el arranque y el reinicio en Symantec IT Management Suite versiones 8.0 anteriores a la versión  8.0 HF4 y Suite versiones 7.6 anteriores a la versión  7.6 HF7, Symantec Ghost Solution Suite versiones 3.1 anteriores a la versión  3.1 MP4, Symantec Endpoint Virtualization versiones 7.x anteriores a la versión 7.6 HF7 y Symantec Encryption Desktop versiones 10.x anteriores a la versión 10.4.1, lo que podría permitir a un usuario malicioso local ejecutar código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T00:51:25.003",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:symantec:encryption_desktop:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A8D6248-A467-42E3-91FB-5DDF0D7F569C",
              "versionEndExcluding": "10.4.1",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_encryption:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "796EE952-7B18-4F2D-A1A7-529A7127C5F5",
              "versionEndExcluding": "7.6",
              "versionStartIncluding": "7.0"
            },
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_encryption:7.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB53496E-9E66-4FB2-A86F-C6153A163305"
            },
            {
              "criteria": "cpe:2.3:a:symantec:ghost_solution_suite:3.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DC2C82A-C0DE-48E0-B805-49F26D523168"
            },
            {
              "criteria": "cpe:2.3:a:symantec:ghost_solution_suite:3.1:maintenance_pack1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3068E0D-EEF2-4D63-AE0D-54025DBD78F5"
            },
            {
              "criteria": "cpe:2.3:a:symantec:ghost_solution_suite:3.1:maintenance_pack2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90A390EB-8DB2-4626-88A1-63E55BEEE716"
            },
            {
              "criteria": "cpe:2.3:a:symantec:ghost_solution_suite:3.1:maintenance_pack3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3B6CC37-2CE2-4F6B-BE0A-50124B09D085"
            },
            {
              "criteria": "cpe:2.3:a:symantec:it_management_suite:7.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F07D13E-7BAC-41E8-8774-6278ED4947CE"
            },
            {
              "criteria": "cpe:2.3:a:symantec:it_management_suite:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D879F92-4706-4D48-BD87-BA689C59E786"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@symantec.com"
}