Description
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications.
References
- 20060421 Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private Key mailing-list
- 17637 vdb-entry
- 19734 third-party-advisory
- 20060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities mailing-list
- 20060421 Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private Key mailing-list
- sse-insecure-private-key(25973) vdb-entry
- http://www.symantec.com/avcenter/security/Content/2006.04.21.html
- ADV-2006-1464 vdb-entry
- 1015974 vdb-entry