Details of VAR-201809-0139

ID

VAR-201809-0139

CVE

CVE-2018-12243

TITLE

Symantec Messaging Gateway In XML External entity vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2018-011521

DESCRIPTION

The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths in the system identifier to access files that should not normally be accessible. Attackers can exploit this issue to gain access to sensitive information or cause denial-of-service conditions. Versions prior to Messaging Gateway 10.6.6 are vulnerable. Symantec Messaging Gateway is a set of anti-spam, anti-virus, advanced content filtering and data leakage prevention technologies developed by Symantec

Trust: 1.98

sources: NVD: CVE-2018-12243 // JVNDB: JVNDB-2018-011521 // BID: 105330 // VULHUB: VHN-122183

AFFECTED PRODUCTS

vendor:	symantec	model:	messaging gateway	scope:	lt	version:	10.6.6	Trust: 1.8
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.5.2	Trust: 0.9
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.5.1	Trust: 0.9
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.0.1	Trust: 0.9
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	9.5.4	Trust: 0.9
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	9.5.3	Trust: 0.9
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	9.5.1	Trust: 0.9
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.0.3	Trust: 0.9
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.0.2	Trust: 0.9
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.0	Trust: 0.9
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.5.0	Trust: 0.6
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6.3	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.5	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	9.5.3-3	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	9.5.2	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	9.5	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6.5	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6.4	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6.3-267	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6.3-266	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6.2	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6.1-3	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6.1	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6.0-7	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6.0-3	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.6	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.1	Trust: 0.3
vendor:	symantec	model:	messaging gateway	scope:	ne	version:	10.6.6	Trust: 0.3

sources: BID: 105330 // JVNDB: JVNDB-2018-011521 // CNNVD: CNNVD-201809-888 // NVD: CVE-2018-12243

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-12243
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-12243
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201809-888
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-122183
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-12243
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-122183
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-12243
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-122183 // JVNDB: JVNDB-2018-011521 // CNNVD: CNNVD-201809-888 // NVD: CVE-2018-12243

PROBLEMTYPE DATA

problemtype:

CWE-611

Trust: 1.9

sources: VULHUB: VHN-122183 // JVNDB: JVNDB-2018-011521 // NVD: CVE-2018-12243

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201809-888

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201809-888

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-011521

PATCH

title:	SYMSA1461	url:	https://support.symantec.com/en_US/article.SYMSA1461.html	Trust: 0.8
title:	Symantec Messaging Gateway Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=85007	Trust: 0.6

sources: JVNDB: JVNDB-2018-011521 // CNNVD: CNNVD-201809-888

EXTERNAL IDS

db:	NVD	id:	CVE-2018-12243	Trust: 2.8
db:	BID	id:	105330	Trust: 1.4
db:	JVNDB	id:	JVNDB-2018-011521	Trust: 0.8
db:	CNNVD	id:	CNNVD-201809-888	Trust: 0.7
db:	VULHUB	id:	VHN-122183	Trust: 0.1

sources: VULHUB: VHN-122183 // BID: 105330 // JVNDB: JVNDB-2018-011521 // CNNVD: CNNVD-201809-888 // NVD: CVE-2018-12243

REFERENCES

url:	https://support.symantec.com/en_us/article.symsa1461.html	Trust: 2.0
url:	http://www.securityfocus.com/bid/105330	Trust: 1.1
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-12243	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-12243	Trust: 0.8
url:	http://www.symantec.com	Trust: 0.3

sources: VULHUB: VHN-122183 // BID: 105330 // JVNDB: JVNDB-2018-011521 // CNNVD: CNNVD-201809-888 // NVD: CVE-2018-12243

CREDITS

Artem Kondratenko, Arseny Sharoglazov, Alexey Osipov from Kaspersky Lab Security Services @kl_secservices

Trust: 0.3

sources: BID: 105330

SOURCES

db:	VULHUB	id:	VHN-122183
db:	BID	id:	105330
db:	JVNDB	id:	JVNDB-2018-011521
db:	CNNVD	id:	CNNVD-201809-888
db:	NVD	id:	CVE-2018-12243

LAST UPDATE DATE

2024-11-23T22:21:56.446000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-122183	date:	2018-12-08T00:00:00
db:	BID	id:	105330	date:	2018-09-19T00:00:00
db:	JVNDB	id:	JVNDB-2018-011521	date:	2019-01-16T00:00:00
db:	CNNVD	id:	CNNVD-201809-888	date:	2018-09-20T00:00:00
db:	NVD	id:	CVE-2018-12243	date:	2024-11-21T03:44:50.910

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-122183	date:	2018-09-19T00:00:00
db:	BID	id:	105330	date:	2018-09-19T00:00:00
db:	JVNDB	id:	JVNDB-2018-011521	date:	2019-01-16T00:00:00
db:	CNNVD	id:	CNNVD-201809-888	date:	2018-09-20T00:00:00
db:	NVD	id:	CVE-2018-12243	date:	2018-09-19T15:29:19.217