CVE-2013-5008

{"id": "CVE-2013-5008", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-10-10T10:55:06.537", "references": [{"url": "http://www.securityfocus.com/bid/62757", "source": "secure@symantec.com"}, {"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20131008_00", "tags": ["Patch", "Vendor Advisory"], "source": "secure@symantec.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The agent and task-agent components in Symantec Management Platform 7.0 and 7.1 before 7.1 SP2 Mp1.1v7 rollup, as used in certain Altiris products, use the same registry-entry encryption key across different customers' installations, which makes it easier for local users to obtain sensitive information about package-server access, or cause a denial of service, by leveraging knowledge of this key."}, {"lang": "es", "value": "Los componentes del agente y del task-agent de Symantec Management Platform 7.0 y 7.1 SP2 Mp1.1v7 rollup, tal como se utiliza en algunos productos de Altiris, utilizan la misma clave de cifrado a trav\u00e9s del registro de entrada para instalaciones de diferentes clientes, lo que hace que sea m\u00e1s f\u00e1cil para los usuarios locales obtener informaci\u00f3n sensible acerca del acceso de paquetes del servidor, o causar una denegaci\u00f3n de servicio, mediante el aprovechamiento de los conocimientos de esta clave."}], "lastModified": "2013-10-10T20:10:41.980", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symantec:management_platform:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B04B5F5-B488-4F85-9CEB-739E8B99FC54"}, {"criteria": "cpe:2.3:a:symantec:management_platform:7.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03C0AEC5-CB51-455B-A76B-F3F7D60F884A"}, {"criteria": "cpe:2.3:a:symantec:management_platform:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7184C7BB-3001-473F-BBE2-B52542A7A09D"}, {"criteria": "cpe:2.3:a:symantec:management_platform:7.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BB7849A-04D6-49F1-B5BD-CBA25714FF92"}], "operator": "OR"}]}], "sourceIdentifier": "secure@symantec.com"}