A weakness has been reported in various Symantec products, which can be exploited by malicious people to conduct phishing attacks.

The weakness is caused due to an error when handling URLs in the login screen of the Reporting Server. This can be exploited to display an arbitrary message on the Reporting Server login screen.

The weakness is reported in the following products and versions:
* Symantec AntiVirus Corporate Edition 10.1 MR7 and prior and 10.2 MR1 and prior
* Symantec Client Security 3.1 MR7 and prior
* Symantec Endpoint Protection 11.0 MR1 and prior

Solution
Update to the latest versions.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Dave Lewis of LiquidMatrix.

Original Advisory
SYM09-008:
http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_00

Deep Links
Links available in Customer Area