Secunia

A security issue has been reported in LiveUpdate Client, which can be exploited by malicious, local users to disclose certain sensitive information.

The security issue is caused due to the client storing the LiveUpdate Server login name and password to a local log file in clear text. This can be exploited by malicious users to disclose the configured login name and password for accessing the LiveUpdate packages.

Successful exploitation requires that the LiveUpdate Server is configured to use user name and password authentication.

The security issue has been reported in LiveUpdate Client version 2.7 build 34.

Solution
Update to version 2.7.38.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Arthur Freyman.

Original Advisory
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2005.09.02.html

Deep Links
Links available in Customer Area