This host is installed with Symantec IM Manager and is prone to code injection vulnerability.

Successful exploitation will allow attacker to execute arbitrary code on the system. Impact Level: Application

Upgarade to Symantec IM Manager version 8.4.17 or later. For updates refer to http://www.symantec.com/business/im-manager

The flaw is caused by an input validation error in the 'ScheduleTask' method of the 'IMAdminSchedTask.asp' page within the administration console when processing a POST variable via an 'eval()' call, which could be exploited by attackers to inject and execute arbitrary ASP code by enticing a logged-in console user to visit a malicious link.

Symantec IM Manager versions 8.4.16 and prior

• http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110131_00
• http://www.vupen.com/english/advisories/2011/0259
• http://www.zerodayinitiative.com/advisories/ZDI-11-037
• http://xforce.iss.net/xforce/xfdb/65040

---

Updated on 2015-03-25