A vulnerability has been reported in Symantec Endpoint Protection Manager, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to an input validation error within the fw_charts.php file of the reporting module, which can be exploited to overwrite arbitrary files on the server and e.g. execute arbitrary PHP code.

According to the vendor, successful exploitation requires that the Symantec Endpoint Protection client is installed and authenticated to the target Symantec Endpoint Protection server.

NOTE: Reportedly, this can also be exploited without proper authentication.

Solution
Upgrade to Symantec Endpoint Protection 11 RU6 MP2.

Provided and/or discovered by
Andrea Micalizzi aka rGod via ZDI

Changelog
Further details available to Secunia VIM customers

Original Advisory
Symantec SYM10-013:
http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20101215_00

ZDI-10-291:
http://www.zerodayinitiative.com/advisories/ZDI-10-291/

Deep Links
Links available to Secunia VIM customers