|
Symantec Products NavComUI ActiveX Control Code Execution
|
|
Secunia Advisory:
|
SA25215
|
|
|
Release Date:
|
2007-08-09
|
|
Popularity:
|
15,118 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Symantec Norton AntiVirus 2006
Symantec Norton Internet Security 2005
Symantec Norton Internet Security 2006
Symantec Norton SystemWorks 2006
|
|
|
Binary Analysis:
|
BA186 :: Available for 1 Credit 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| CVE reference: | CVE-2007-2955
|
|
Description:
Secunia Research has discovered two vulnerabilities in various Symantec products, which can be exploited by malicious people to compromise a user's system.
The vulnerabilities are caused due to errors in the AxSysListView32 and AxSysListView32OAA ActiveX controls (NavComUI.dll) when handling the "AnomalyList" and "Anomaly" properties respectively as they take a VARIANT* as argument.
Successful exploitation allows execution of arbitrary code.
The vulnerabilities have been confirmed in Norton Internet Security 2006 including Norton AntiVirus 12.7.0.2. According to the vendor, the following versions are affected:
* Norton AntiVirus 2006
* Norton Internet Security 2006
* Norton Internet Security, Anti Spyware Edition 2005
* Norton System Works 2006
Solution:
The vendor has issued a fix, which is available via LiveUpdate in Interactive Mode.
Provided and/or discovered by:
Carsten Eiram, Secunia Research.
Original Advisory:
Secunia Research:
http://secunia.com/secunia_research/2007-53/
Symantec:
http://www.symantec.com/avcenter/security/Content/2007.08.09.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
