Dominique GREGOIRE has reported a security issue in InterScan Messaging Security Suite (IMSS), which can be exploited by malicious, local users to gain escalated privileges.

The problem is that insecure default permissions (grants "Everyone" group "Full Control") are set on the "ISNTSmtp" subdirectory. This can be exploited to remove, manipulate, and replace any of the application's files.

The security issue has been reported in version 5.5 build 1183. Other versions may also be affected. The security issue could not be confirmed in version 5.7.0.1121 and may therefore have been fixed silently in an unknown version.

Solution
Update to version 5.7.0.1121 or later.

Provided and/or discovered by
Dominique GREGOIRE

Changelog
Further details available in Customer Area

Original Advisory
http://www.secumind.net/content/french/modules/news/article.php?storyid=9

Deep Links
Links available in Customer Area