Today was a day when everything seemed to go wrong, beginning with dropping my smartphone on the ground, shattering the screen. If she was active on social media, she would probably share her story and describe it like this:Ī Day Plagued by #Misfortune: The Broken Smartphone 🌩️📱😩 What I describe below happened yesterday to someone I care deeply about.

#redteam #infosec #pentest #0day #disclosure If you have not upgraded, then probably you are already affected by CVE-2018-18367. However, there is no security advisory, because of their dependency from 3rd party vendor.īeing a strong believer of responsible disclosure, and talking into consideration all the above, I release the exploit.Īs far as you have upgraded to the latest SEPM, my guess is that you will have no problems. I have to stress at that point, that I tested the exploitation against 'Symantec EndPoint Manager 14.2.1 (14.2 RU1) build 3332 (.1000)', and it seems that Symantec applied a patch. These days (end of July) they informed me for a new delay, until mid to late August. Initially, they asked from me to expand the 90 days disclosure and wait until June 2018. However, for the second one and after 8 months (!) of waiting, there is no advisory yet. They published the advisory for the CVE after 140 days! On November 2018, I informed Symantec for two vulnerabilities in Symantec Manager, which could allow escalation of privilege (EoP).īoth vulnerabilities have been verified by Symantec and one of them has been assigned CVE-2018-18367.

Sepm 14.2