With Tamper Protection enabled, the vulnerability still exists but exploitability is much, much lower. With this feature disabled (we have seen various environments with this disabled or tuned down), exploitability of the vulnerability is high. It is my stance that this is a vulnerability regardless if Tamper Protection is enabled or not. Tamper protection being disabled in massive organizations is a common thing that is observed. In order for this vulnerability to be reliably exploited, Symantec Endpoint Protection’s “Tamper Protection” feature needs to be disabled.

This vulnerability was found in conjunction with Marcus Sailler, Rick Romo and Gary Muller of Capital Group’s Security Testing Team

Symantec Endpoint Protection Version: 14.2 RU1 Build 3335 (.1000) and below Operating System Tested On: Wind圆4 If you have further questions about this article, contact Dell Technical Support.CVE-2019–12757: Local Privilege Escalation in Symantec Endpoint Protection There are additional workarounds on the website: This fixes the issue on Windows client OSes and for Server 2016. The easiest and best solution is to update to Symantec Endpoint Protection 14.2 RU2 MP1 (Build 5569) or later. Symantec’s website has posted an update on February 3, 2020.

You are running any version of Symantec Endpoint Protection on Windows Server 2016 or earlier (less common) with EOC 79.

You are running a version of Symantec Endpoint Protection earlier than 14.2 RU2 MP1 (Build 5569) on a Windows Client Operating System (OS) with EOC 79.

If you are using an older version of Symantec Endpoint Protection, you experience a SNAP error that causes Microsoft's Edge browser to not display pages. The following article contains information about old versions of Symantec Endpoint Protection causing issues with Microsoft's Edge browser.Įdge Browser Not Displaying Pages Because Of An Older Version Of Symantec Endpoint Protection Is Being Used

Symantec endpoint protection 14.2