CVE-2018-5243 Denial of service in Symantec Encryption Management Server (SEMS)

What is CVE-2018-5243?

CVE-2018-5243 is a high-severity denial of service vulnerability in Symantec Encryption Management Server (SEMS), published on 20 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploit. A DoS attack is a type of attack whereby the perpetrator attempts to make a particular machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a specific host within a network.

Weakness: CWE-400

Which versions are affected by CVE-2018-5243?

It affects 1 product.

Products include Symantec Encryption Management Server.

How do I fix CVE-2018-5243?

No fix has been published for CVE-2018-5243 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-5243 being exploited?

There is no known exploitation of CVE-2018-5243 in the wild and no public exploit code.

Other vulnerabilities in Symantec Encryption Management Server (SEMS)

• CVE-2015-8151 Command injection in n/a Critical 9.1
• CVE-2014-7288 Command injection in n/a Critical 9.0
• CVE-2015-8150 Privilege escalation in n/a High 7.8
• CVE-2015-8148 Information disclosure in n/a High 7.5
• CVE-2015-8149 Memory corruption in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w8qw-x88f-f35r.