Overview
The following Symantec Enterprise Security Manager (ESM) components are susceptible to the Java Runtime Environment (JRE) vulnerability:

• Symantec ESM 6.5.x/6.5.3 SP1/6.5.3 SP2 manager/agent/console
• Symantec ESM 6.5.x utilities
• Symantec Enterprise Reporting Database Link (RDL) 6.1.1/6.5.3/6.5.3 SP1/6.5.3 SP2
• Symantec Enterprise Reporting 6.1.1/6.5.3/6.5.3 SP1/6.5.3 SP2

Information on Updates made on August 29, 2008
Some ESM Customer were getting Dr. Watson error and an error DUMP when they tried to apply the JRE Vulnerability patch dated November 28,2007 for RDL and/or Enterprise Reporting on Windows. The errors were displayed because the DEP (Data execution prevention) setting did not allow the installers to execute. This issue has been resolved by publishing the new installers, as of August 29, 2008.

If you have downloaded the JRE patch prior to August 29, 2008 and want to apply it for RDL and/or Enterprise Reporting without changing the DEP (Data Execution Prevention) Setting, you should download the zip file available at the following location, extract the Installers and run them.

Note: You do not have to download this Update if you have already applied the patch dated November 28, 2007 for RDL or Enterprise Reporting and not having errors with DEP settings.

For Enterprise Reporting:
<Relative path>\JRE_Vulnerability_Fix\EnterpriseReporting_JRE_PATCH\Win_Solaris_ESM65\Windows\install.exe

For Reporting Database Link (RDL):
<Relative path>\JRE JRE_Vulnerability_Fix\RDL_JRE_PATCH\Windows\install.exe

Symantec response
Symantec has released downloadable JRE fixes for the ESM 6.5.x components (see the list below). The fix and complete instructions to update the JRE for the ESM 6.5.x components are specified in the Symantec ESM JRE Vulnerability Fix Update Guide.

ESM JRE Vulnerability Fix

ESM JRE Vulnerability Fix Update Guide

To date, Symantec is not aware of any reported attempts to exploit this vulnerability.

Vulnerable Products
The JRE updates for the following supported ESM platforms are available for immediate download (see above):

ESM agent platform	ESM version
Windows XP Professional (x86) Windows Server 2003 Standard Edition SP1 (x86) Windows Server 2003 Enterprise Edition SP1 (x86) Windows 2000 (Professional, Server, Advanced Server)	6.5.0/6.5.2/6.5.3/6.5.3SP1/6.5.3SP2 (English Version only)

ESM manager platform	ESM version
Windows 2000 Professional SP1+ Windows 2000 Server SP1+ Windows 2000 Advanced Server SP1+ Windows Server 2003	6.5.0/6.5.2/6.5.3/6.5.3SP1/6.5.3SP2 (English Version only)

ESM console platform	ESM version
Windows 2000 Professional, Server, or Advanced Server Windows Server 2003(x86) Windows XP Professional Windows Vista (x86)	6.5.0/6.5.2/6.5.3/6.5.3SP1/6.5.3SP2 (English Version only)

ESM utilities platform	ESM version
Windows 2000 Server, or Advanced Server Windows Server 2003(x86)	6.5.0/6.5.2/6.5.3 (English Version only)

RDL platform	ESM version
Windows 2000 Server Windows Server 2003 Solaris 8/9/10	6.1.1/6.5.3/6.5.3SP1/6.5.3SP2 (English Version only)

Symantec Enterprise Reporting platform	ESM version
Windows 2000 Server Windows Server 2003 Solaris 8/9	6.1.1/6.5.3/6.5.3SP1/6.5.3SP2 (English Version only)