Symantec patches Ghost Solution Suite
Symantec has released an update for its Ghost Solution Suite, which fixes a vulnerability in the way the Ghost console communicates with the Ghost Management Agent. The report admits that the Suite does not authenticate network connections, thus giving a potential attacker access to all clients and the ability to execute commands on the clients with System privileges. However, to exploit the weakness, the attacker would have to have previously initiated an ARP spoofing attack to impersonate the Symantec Ghost Solution Suite server.
The vulnerability affects Versions 1.1, 2.0.0 and 2.0.1. The update for Version 1.1 may be downloaded here: Symantec Ghost Solution Suite 1.1: Server Authentication Vulnerability. Versions 2.x will receive the update via LiveUpdate.
The Ghost Solution Suite is designed to deploy software under Windows and supports imaging.
See also:
- Symantec Ghost Solution Suite: server authentication vulnerability, advisory from Symantec.
(ehe)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
