Vulnerability Details : CVE-2016-9094
Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs can be exported for review by the user in a variety of formats including .CSV files. Prior to 14.0 MP1 and 12.1 RU6 MP7, the potential exists for file metadata to be interpreted and evaluated as a formula. Successful exploitation of an attack of this type requires considerable direct user-interaction from the user exporting and then opening the log files on the intended target client.
Vulnerability category: Input validation
Products affected by CVE-2016-9094
- cpe:2.3:a:symantec:endpoint_protection:*:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp7:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-9094
0.30%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 52 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-9094
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2016-9094
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-9094
-
http://www.securitytracker.com/id/1037961
Symantec Endpoint Protection Lets Local Users Gain Elevated Privileges and Remote Users Injection Formulas into Exported CSV Files in Certain Cases - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/96298
Symantec Endpoint Protection CVE-2016-9094 Local Command Injection VulnerabilityThird Party Advisory;VDB Entry
-
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170306_00
Symantec Endpoint Protection Clients Local Elevation of Privilege, CSV Formula InjectionVendor Advisory
Jump to