CVE-2016-9094 Code injection in Endpoint Protection

High 7.8 Published 16 Apr 2018 Updated 16 Sep 2024

Attackers can execute arbitrary code via CSV formula injection in Symantec Endpoint Protection quarantine logs when users export and open them.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2016-9094?

CVE-2016-9094 is a high-severity code injection vulnerability in Symantec Endpoint Protection, published on 16 Apr 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs can be exported for review by the user in a variety of formats including .CSV files. Prior to 14.0 MP1 and 12.1 RU6 MP7, the potential exists for file metadata to be interpreted and evaluated as a formula. Successful exploitation of an attack of this type requires considerable direct user-interaction from the user exporting and then opening the log files on the intended target client.

Weakness: CWE-20

Which versions are affected by CVE-2016-9094?

It affects 1 product.

Products include Symantec Endpoint Protection.

How do I fix CVE-2016-9094?

No fix has been published for CVE-2016-9094 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2016-9094 being exploited?

There is no known exploitation of CVE-2016-9094 in the wild and no public exploit code.

All Symantec Endpoint Protection vulnerabilities

Sources

Also known as GHSA-cgj4-g3hw-mr32.