Symantec LiveUpdate Administrator Unauthenticated Vulnerabilities

Two vulnerabilities have been identified in Symantec LiveUpdate Administrator, which can be exploited by remote user to inject SQL commands. A remote user can reset account passwords to arbitrary values.

• The management web interface does not properly validate user-supplied input. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.
• The management web interface does not provide proper protection for the forgotten password function. A remote user with knowledge of a valid user account email address can reset the target account's password to an arbitrary value.