Secunia

Matousec has discovered a vulnerability in various Symantec products, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to an input validation error in SPBBCDrv.sys when handling parameters of certain hooked functions. This can be exploited to crash the system by calling NtCreateMutant or NtOpenEvent with specially crafted parameters.

The vulnerability is confirmed in Symantec Norton Personal Firewall 2006 version 9.0.0.73 and also reported in versions 9.1.1.7 and 9.1.0.33. Other versions may also be affected.

Solution
Update to a fixed version using LiveUpdate in Interactive Mode or apply patches (see vendor advisory for details).

Provided and/or discovered by
Matousec Transparent Security

Changelog
Further details available in Customer Area

Original Advisory
Matousec Transparent Security:
http://www.matousec.com/info/advisories/Norton-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php

Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2008.12.12.html

Deep Links
Links available in Customer Area