Endpoint Protection

Environment- Windows 7 Pro clients, IE 9, SEP 12.1.4, Adobe Flash Player and Adobe Reader.

We're just seeking information - haven't given this one much thought until recently.

Does/How does SEP 12.1.4 protect Windows 7/IE clients running Flash Player?

Does Symantec publish AV, PTP and IPS signatures to protect clients from known Adobe Flash Player expoits?

Thanks in advance,

Wally

There would be IPS signatures available as well as firewall to block connections and AV signatures to detect the malware.

Here's a good article in regards to protection against it:

https://www-secure.symantec.com/connect/blogs/unconfirmed-zero-day-vulnerability-discovered-adobe-flash-player

welcome

Thanks.

Hi Brian,

I'm not having much success with the link.   Can't get the blog to display - tried two different machines/browsers.

If it's not a big blog - would it be possible to attach/cut/paste the content in a reply here?

Thanks,

Wally

Not sure what's going on but I was able to get to it. I'll try a copy/paste:

Mitigation
Users of Internet Explorer versions 10 and 11 who are concerned about this issue can temporarily disable Adobe Flash by taking the following steps:

1. Open Internet Explorer
2. Click on the “Tools” menu, and then click “Manage add-ons”
3. Under “Show”, select “All add-ons”
4. Select “Shockwave Flash Object” and then click on the disable button

You can re-enable Adobe Flash by repeating the same process, selecting “Shockwave Flash Object” and then clicking on the disable button.

Guidance for users of earlier versions of Internet Explorer is available on Microsoft's website. Select the version of Internet Explorer you are using in the top right corner.

Symantec and Norton protection
Symantec and Norton products have the following detections in place to protect against instances of the Angler exploit kit attempting to take advantage of this unconfirmed vulnerability:

Antivirus

• Trojan.Swifi

Intrusion prevention system

• Web Attack: Angler Exploit Kit Website 15
• Web Attack: Angler Exploit Kit Website 6

Additionally, Symantec and Norton products detect other instances of the Angler exploit kit with the following intrusion prevent signatures:

• Web Attack: Angler Exploit Kit Website 12
• Web Attack: Angler Exploit Kit Website 9
• Web Attack: Angler Exploit kit Flash Download 3
• Web Attack: Angler Exploit Kit Website 8
• Web Attack: Angler Exploit Kit Website 7
• Web Attack: Angler Exploit Kit Silverlight Exploit
• Web Attack: Angler Exploit kit Flash Download 2
• Web Attack: Angler Exploit kit Flash Download
• Web Attack: Angler Exploit Kit Website 2
• Web Attack: Angler Exploit Kit Website

Thanks