A vulnerability was found in Symantec Ghost up to 3.1 MP3. It has been declared as problematic. This vulnerability affects some unknown processing of the component DLL Loader. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability.

The bug was discovered 11/15/2016. The weakness was disclosed 11/16/2016 by Himanshu Mehta as confirmed security advisory (Website). The advisory is shared for download at symantec.com. This vulnerability was named CVE-2016-6590 since 08/03/2016. The exploitation appears to be easy. The attack needs to be approached locally. Required for exploitation is a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 370438 (Symantec Ghost Solution Suite DLL Loading Issue (SYM16-020)).

Applying the patch 3.1 MP4 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at SecurityTracker (ID 1037302†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Symantec

Name

• Ghost

Version

• 3.1 MP3

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion