Secunia

Two vulnerabilities have been reported in various Symantec products, which can be exploited by malicious people to compromise a user's system.

1) A boundary error within an ActiveX control (SYMADATA.DLL) included in the AutoFix Support Tool can be exploited to cause a stack-based buffer overflow.

2) A design error in the same ActiveX control can be exploited to e.g. load and execute arbitrary code from a remote share.

Successful exploitation of the vulnerabilities allows execution of arbitrary code, but requires that the attacker e.g. conducts DNS poisoning or cross-site scripting attacks as the ActiveX control is site-locked and can only be scripted from a trusted domain.

The vulnerabilities affect the following products:
* Norton 360 1.0
* Norton AntiVirus 2006-2008
* Norton Internet Security2006-2008
* Norton System Works 2006-2008

Solution
Apply updates.
Further details available in Customer Area

Provided and/or discovered by
1) Peter Vreugdenhill, reported via iDefense Labs
2) An anonymous researcher, reported via iDefense Labs

Changelog
Further details available in Customer Area

Original Advisory
SYM08-009:
http://securityresponse.symantec.com/avcenter/security/Content/2008.04.02a.html

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=677
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=678

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area