Endpoint Protection

When we are running nessus tool to find out if there any loophole in the network. It's finding port 8445 as a vulnerability port.

8445 is used by SEPM then how it can show vulneraility on that port?

Hi,

Thank you for posting in Symantec community.

Check with support if there is any known issue with nessus tool.

You should log a case with support to find out more info on that.

Regional Support Telephone Numbers:
United States: https://support.broadcom.com (407-357-7600 from outside the United States)
Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp

OR

Can create a web case as well.

How to create a new case in MySupport

http://www.symantec.com/docs/TECH58873

http://www.symantec.com/business/support/index?page=content&id=TECH163787

What is the version of SEPM?

I would suggest upgrading to 12.1 RU3 as it fixes a known vulnerability. See here:

https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130618_00

Hello,

What version of SEPM are you running??

TCP port 8445 initiated by Reporting Console used by process - httpd.exe (Apache) of SEP 12.1.x.

In case you are running an older version of SEPM, it is recommended to Migrate the same to the Latest version of SEPM / SEP clients. Currently the Latest version of SEPM / SEP clients is SEP 12.1.3001 (RU3).

Latest Symantec Endpoint Protection Released - SEP 12.1.RU3

https://www-secure.symantec.com/connect/blogs/latest-symantec-endpoint-protection-released-sep-121ru3

What are the officially released versions of Symantec Endpoint Protection (SEP)?

http://www.symantec.com/docs/TECH154475

Responsible security researchers work with the Symantec Product Security team through the email address secure@symantec.com. Responsible finders understand that the customer's security is paramount, so they work with us to make sure the patch is available--and customers have had adequate time to deploy the patch--prior to discussing the vulnerability in public forums or releasing exploit code.

http://www.symantec.com/security/?inid=us_sr_flyout_contact_reportvul

Here is the post which might also be of interest:

New Vulnerability in SEPM: SYM13-005, Fixed by Upgrading to 12.1 RU3

https://www-secure.symantec.com/connect/forums/new-vulnerability-sepm-sym13-005-fixed-upgrading-121-ru3

In case of any doubts, please Create a Case with Symantec Technical Support.

How to create a new case in MySymantec

http://www.symantec.com/business/support/index?page=content&id=TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

• United States: https://support.broadcom.com (407-357-7600 from outside the United States)
• Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
• United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_t...

HI, 

Upgrade to latest version and run the tool again.

Regards

Ajin

Support confirmed the workaround with this issue. You can modify default string value though it's not supported.