CVE-2024-23617
📋 TL;DR
A buffer overflow vulnerability in Symantec Data Loss Prevention allows remote, unauthenticated attackers to execute arbitrary code by tricking users into opening malicious documents. This affects versions 14.0.2 and earlier, potentially compromising entire systems.
💻 Affected Systems
- Symantec Data Loss Prevention
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the affected machine, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Remote code execution leading to malware installation, data exfiltration, or system disruption.
If Mitigated
Limited impact if proper network segmentation, least privilege, and application whitelisting are implemented.
🎯 Exploit Status
Exploitation requires social engineering to get user to open malicious document; technical exploitation is straightforward once document is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.0.3 or later
Vendor Advisory: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/246823
Restart Required: Yes
Instructions:
1. Download and install Symantec Data Loss Prevention version 14.0.3 or later from Broadcom support portal. 2. Apply patch to all affected systems. 3. Restart systems to complete installation.
🔧 Temporary Workarounds
Document Type Restrictions
allBlock or restrict processing of suspicious document types via DLP policies.
User Awareness Training
allTrain users to avoid opening unexpected or suspicious documents.
🧯 If You Can't Patch
- Implement network segmentation to isolate DLP systems from critical assets.
- Deploy application control/whitelisting to prevent execution of unauthorized code.
🔍 How to Verify
Check if Vulnerable:
Check Symantec DLP version via Control Center or command line: 'dlp version' or examine installed programs list.Check Version:
dlp versionVerify Fix Applied:
Verify version is 14.0.3 or later using same methods; check patch installation logs.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from DLP components
- Crash logs involving wp6sr.dll
- Failed document processing attempts
Network Indicators:
- Outbound connections from DLP systems to unknown IPs post-document processing
SIEM Query:
source="dlp_logs" AND (event_id="process_creation" AND parent_process="wp6sr.dll") OR (event_id="crash" AND module="wp6sr.dll")