Stormshield Endpoint Security

CVSS v2 Overall Score: 2      

Analysis

Impacted version

During the update process of a 7.1.x version of Stormshield Endpoint Security (SES) to the 7.2.0 version, updated agents may apply the default security policy instead of the intended policy defined by the customer.

This issue occurs when an agent downloads a security policy from a 7.2.0 server before updating itself to version 7.2.0. In this case, the default security policy will be applied when the agent updates to 7.2.0.

• SES v7.2.00

Workaround solution

Solution

It is possible to force newly updated agents to apply the intended security policy by resynchronizing the security policy from the management console after the agents have been migrated to version 7.2.0 (the security policy must be modified in some way in order to generate a new version of the security policy).

7.2.01 update correcting this vulnerability is available since May 11^th 2015.