Description
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests.
References
- 17637 vdb-entry
- 20060421 Rapid7 Advisory R7-0023: Symantec Scan Engine File Disclosure Vulnerability mailing-list
- 19734 third-party-advisory
- 20060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities mailing-list
- sse-unauth-file-access(25974) vdb-entry
- 758 third-party-advisory
- 759 third-party-advisory
- 20060421 Rapid7 Advisory R7-0023: Symantec Scan Engine File Disclosure Vulnerability mailing-list
- http://www.symantec.com/avcenter/security/Content/2006.04.21.html
- ADV-2006-1464 vdb-entry
- 1015974 vdb-entry