CVE-2016-2203

38Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 7.1%

from disclosure to weapon0 days

Published on NVDApr 22

1st PoCApr 21

metasploitDec 17

exploitation probability

7.1%top 7% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveraging certain read privileges.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/136758/Symantec-Brightmail-10.6.0-7-LDAP-Credential-Grabber.htmlunverified cve_referencewww.exploit-db.com/exploits/39715/unverified exploitdbwww.exploit-db.com/exploits/39715unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/136758/Symantec-Brightmail-10.6.0-7-LDAP-Credential-Grabber.html https://www.exploit-db.com/exploits/39715/http://www.securityfocus.com/bid/86137 http://www.securitytracker.com/id/1035609 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160418_00