Details of VAR-200609-0008

ID

VAR-200609-0008

CVE

CVE-2006-3454

TITLE

Symantec AntiVirus Corporate Edition Format string vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2006-002728

DESCRIPTION

Multiple format string vulnerabilities in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security 1.x up to 3.0, allow local users to execute arbitrary code via format strings in (1) Tamper Protection and (2) Virus Alert Notification messages. Symantec AntiVirus Corporate Edition is prone to multiple format-string vulnerabilities because it fails to properly sanitize user-supplied input before using it in the format-specifier argument to a formatted-printing function. Successfully exploiting these vulnerabilities may allow an attacker to execute arbitrary machine code with SYSTEM-level privileges. Attackers may also crash the Real Time Virus Scan service. Symantec AntiVirus is a very popular antivirus solution. ---------------------------------------------------------------------- Want to work within IT-Security? Secunia is expanding its team of highly skilled security experts. We will help with relocation and obtaining a work permit. 2) Another format string error exists in the alert notification process when displaying a notification message upon detection of a malicious file. SOLUTION: Apply patches (see patch matrix in vendor advisory). PROVIDED AND/OR DISCOVERED BY: 1) David Heiland, Layered Defense. 2) Reported by the vendor ORIGINAL ADVISORY: Symantec: http://securityresponse.symantec.com/avcenter/security/Content/2006.09.13.html Layered Defense: http://layereddefense.com/SAV13SEPT.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . 09/13/2006 \x96 Vendor Public disclosure. ================================================== 6) Credits Discovered by Deral Heiland, www.LayeredDefense.com ================================================== 7) References CVE Reference: CVE-2006-3454 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3454 ================================================== 9) About Layered Defense Layered Defense, Is a group of security professionals that work together on ethical Research, Testing and Training within the information security arena. http://www.layereddefense.com ================================================== _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . http://www.layereddefense.com ==================================================

Trust: 2.25

sources: NVD: CVE-2006-3454 // JVNDB: JVNDB-2006-002728 // BID: 19986 // VULHUB: VHN-19562 // PACKETSTORM: 50042 // PACKETSTORM: 50052 // PACKETSTORM: 50093

AFFECTED PRODUCTS

vendor:	symantec	model:	client security	scope:	eq	version:	3.0	Trust: 1.9
vendor:	symantec	model:	client security	scope:	eq	version:	2.0	Trust: 1.9
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	9.0	Trust: 1.6
vendor:	symantec	model:	client security	scope:	eq	version:	2.0.3	Trust: 1.6
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	9.0.1	Trust: 1.6
vendor:	symantec	model:	client security	scope:	eq	version:	2.0.2	Trust: 1.6
vendor:	symantec	model:	client security	scope:	eq	version:	2.0.1	Trust: 1.6
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	10.0	Trust: 1.6
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	8.1	Trust: 1.6
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	9.0.2	Trust: 1.6
vendor:	symantec	model:	client security	scope:	eq	version:	1.1.1	Trust: 1.3
vendor:	symantec	model:	client security	scope:	eq	version:	1.1	Trust: 1.3
vendor:	symantec	model:	client security	scope:	eq	version:	1.0.1	Trust: 1.3
vendor:	symantec	model:	client security	scope:	eq	version:	1.0	Trust: 1.3
vendor:	symantec	model:	client security	scope:	eq	version:	2.0.4	Trust: 1.0
vendor:	symantec	model:	client security	scope:	eq	version:	1.x to 3.0	Trust: 0.8
vendor:	symantec	model:	norton antivirus	scope:	eq	version:	corporate edition 8.1 to 10.0	Trust: 0.8
vendor:	symantec	model:	client security	scope:	eq	version:	3.0.2.2011	Trust: 0.3
vendor:	symantec	model:	client security	scope:	eq	version:	3.0.2.2010	Trust: 0.3
vendor:	symantec	model:	client security	scope:	eq	version:	3.0.2.2002	Trust: 0.3
vendor:	symantec	model:	client security	scope:	eq	version:	3.0.2.2001	Trust: 0.3
vendor:	symantec	model:	client security	scope:	eq	version:	3.0.2.2000	Trust: 0.3
vendor:	symantec	model:	client security mr3 b9.0.3.1000	scope:	eq	version:	2.0.3	Trust: 0.3
vendor:	symantec	model:	client security mr2 b9.0.2.1000	scope:	eq	version:	2.0.2	Trust: 0.3
vendor:	symantec	model:	client security mr1 b9.0.1.1000	scope:	eq	version:	2.0.1	Trust: 0.3
vendor:	symantec	model:	client security stm build	scope:	eq	version:	2.09.0.0.338	Trust: 0.3
vendor:	symantec	model:	client security (scf	scope:	eq	version:	2.07.1)	Trust: 0.3
vendor:	symantec	model:	client security mr5 build	scope:	eq	version:	1.1.18.1.1.336	Trust: 0.3
vendor:	symantec	model:	client security mr4 build	scope:	eq	version:	1.1.18.1.1.329	Trust: 0.3
vendor:	symantec	model:	client security mr3 build	scope:	eq	version:	1.1.18.1.1.323	Trust: 0.3
vendor:	symantec	model:	client security mr2 build	scope:	eq	version:	1.1.18.1.1.319	Trust: 0.3
vendor:	symantec	model:	client security mr1 build 8.1.1.314a	scope:	eq	version:	1.1.1	Trust: 0.3
vendor:	symantec	model:	client security mr6 b8.1.1.266	scope:	eq	version:	1.1.1	Trust: 0.3
vendor:	symantec	model:	client security stm b8.1.0.825a	scope:	eq	version:	1.1	Trust: 0.3
vendor:	symantec	model:	client security mr8 build	scope:	eq	version:	1.0.18.01.471	Trust: 0.3
vendor:	symantec	model:	client security mr7 build	scope:	eq	version:	1.0.18.01.464	Trust: 0.3
vendor:	symantec	model:	client security mr6 build	scope:	eq	version:	1.0.18.01.460	Trust: 0.3
vendor:	symantec	model:	client security mr5 build	scope:	eq	version:	1.0.18.01.457	Trust: 0.3
vendor:	symantec	model:	client security mr4 build	scope:	eq	version:	1.0.18.01.446	Trust: 0.3
vendor:	symantec	model:	client security mr3 build	scope:	eq	version:	1.0.18.01.434	Trust: 0.3
vendor:	symantec	model:	client security build	scope:	eq	version:	1.0.18.01.437	Trust: 0.3
vendor:	symantec	model:	client security mr9 b8.01.501	scope:	eq	version:	1.0.1	Trust: 0.3
vendor:	symantec	model:	client security mr2 b8.01.429c	scope:	eq	version:	1.0.1	Trust: 0.3
vendor:	symantec	model:	client security mr1 b8.01.425a/b	scope:	eq	version:	1.0.1	Trust: 0.3
vendor:	symantec	model:	client security b8.01.9378	scope:	eq	version:	1.0.0	Trust: 0.3
vendor:	symantec	model:	client security b8.01.9374	scope:	eq	version:	1.0	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	10.0.2.2011	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	10.0.2.2010	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	10.0.2.2002	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	10.0.2.2001	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	10.0.2.2000	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	10.0	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	9.0.5	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	9.0.4	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	9.0.3.1000	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	9.0.2.1000	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	9.0.1.1.1000	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	9.0.0.338	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	9.0	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	eq	version:	8.1.18.1.1.329	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	eq	version:	8.1.18.1.1.323	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	eq	version:	8.1.18.1.1.319	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build 8.1.1.314a	scope:	eq	version:	8.1.1	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	8.1.1.377	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	8.1.1.366	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	8.1.1	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	eq	version:	8.18.01.471	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	eq	version:	8.18.01.464	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	eq	version:	8.18.01.460	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	eq	version:	8.18.01.457	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	eq	version:	8.18.01.446	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	eq	version:	8.18.01.437	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	eq	version:	8.18.01.434	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition .0.825a	scope:	eq	version:	8.1	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	eq	version:	8.1	Trust: 0.3
vendor:	symantec	model:	client security	scope:	ne	version:	3.0.2.2020	Trust: 0.3
vendor:	symantec	model:	client security build	scope:	ne	version:	2.0.51100	Trust: 0.3
vendor:	symantec	model:	client security build	scope:	ne	version:	1.1.1393	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	ne	version:	10.0.2.2020	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition	scope:	ne	version:	9.0.5.1100	Trust: 0.3
vendor:	symantec	model:	antivirus corporate edition build	scope:	ne	version:	8.1.1393	Trust: 0.3

sources: BID: 19986 // JVNDB: JVNDB-2006-002728 // CNNVD: CNNVD-200609-205 // NVD: CVE-2006-3454

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2006-3454
value:	HIGH
Trust: 1.0
NVD:	CVE-2006-3454
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200609-205
value:	HIGH
Trust: 0.6
VULHUB:	VHN-19562
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2006-3454
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-19562
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-19562 // JVNDB: JVNDB-2006-002728 // CNNVD: CNNVD-200609-205 // NVD: CVE-2006-3454

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-3454

THREAT TYPE

local

Trust: 1.1

sources: BID: 19986 // PACKETSTORM: 50042 // PACKETSTORM: 50052 // CNNVD: CNNVD-200609-205

TYPE

format string

Trust: 0.6

sources: CNNVD: CNNVD-200609-205

CONFIGURATIONS

sources: JVNDB: JVNDB-2006-002728

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-19562

PATCH

title:

SYM06-017

url:

http://securityresponse.symantec.com/avcenter/security/Content/2006.09.13.html

Trust: 0.8

sources: JVNDB: JVNDB-2006-002728

EXTERNAL IDS

db:	NVD	id:	CVE-2006-3454	Trust: 3.0
db:	BID	id:	19986	Trust: 2.0
db:	SECUNIA	id:	21884	Trust: 1.8
db:	VUPEN	id:	ADV-2006-3599	Trust: 1.7
db:	SECTRACK	id:	1016842	Trust: 1.7
db:	JVNDB	id:	JVNDB-2006-002728	Trust: 0.8
db:	CNNVD	id:	CNNVD-200609-205	Trust: 0.7
db:	BUGTRAQ	id:	20060918 SYMANTEC SECURITY ADVISORY: SYMANTEC ANTIVIRUS CORPORATE EDITION	Trust: 0.6
db:	BUGTRAQ	id:	20060914 LAYERED DEFENSE ADVISORY :SYMANTEC ANTIVIRUS CORPORATE EDITION FORMAT STRING VULNERABILITY	Trust: 0.6
db:	XF	id:	28936	Trust: 0.6
db:	PACKETSTORM	id:	50093	Trust: 0.2
db:	VULHUB	id:	VHN-19562	Trust: 0.1
db:	PACKETSTORM	id:	50042	Trust: 0.1
db:	PACKETSTORM	id:	50052	Trust: 0.1

sources: VULHUB: VHN-19562 // BID: 19986 // JVNDB: JVNDB-2006-002728 // PACKETSTORM: 50042 // PACKETSTORM: 50052 // PACKETSTORM: 50093 // CNNVD: CNNVD-200609-205 // NVD: CVE-2006-3454

REFERENCES

url:	http://securityresponse.symantec.com/avcenter/security/content/2006.09.13.html	Trust: 2.1
url:	http://layereddefense.com/sav13sept.html	Trust: 1.8
url:	http://www.securityfocus.com/bid/19986	Trust: 1.7
url:	http://securitytracker.com/id?1016842	Trust: 1.7
url:	http://secunia.com/advisories/21884	Trust: 1.7
url:	http://www.securityfocus.com/archive/1/446041/100/0/threaded	Trust: 1.1
url:	http://www.securityfocus.com/archive/1/446293/100/0/threaded	Trust: 1.1
url:	http://www.vupen.com/english/advisories/2006/3599	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/28936	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-3454	Trust: 1.0
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-3454	Trust: 0.8
url:	http://www.frsirt.com/english/advisories/2006/3599	Trust: 0.6
url:	http://xforce.iss.net/xforce/xfdb/28936	Trust: 0.6
url:	http://www.securityfocus.com/archive/1/archive/1/446293/100/0/threaded	Trust: 0.6
url:	http://www.securityfocus.com/archive/1/archive/1/446041/100/0/threaded	Trust: 0.6
url:	http://www.layereddefense.com	Trust: 0.4
url:	http://www.symantec.com/products/enterprise?c=prodinfo&refid=805	Trust: 0.3
url:	/archive/1/446041	Trust: 0.3
url:	http://www.symantec.com/avcenter/security/content/2006.09.13.html	Trust: 0.2
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1
url:	http://secunia.com/quality_assurance_analyst/	Trust: 0.1
url:	http://secunia.com/product/3549/	Trust: 0.1
url:	http://secunia.com/product/6649/	Trust: 0.1
url:	http://secunia.com/product/3478/	Trust: 0.1
url:	http://secunia.com/hardcore_disassembler_and_reverse_engineer/	Trust: 0.1
url:	http://secunia.com/product/2344/	Trust: 0.1
url:	http://secunia.com/product/5555/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/product/659/	Trust: 0.1
url:	http://secunia.com/web_application_security_specialist/	Trust: 0.1
url:	http://secunia.com/advisories/21884/	Trust: 0.1
url:	http://secunia.com/	Trust: 0.1
url:	http://lists.grok.org.uk/full-disclosure-charter.html	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2006-3454	Trust: 0.1

CREDITS

Deral Heiland http://www.layereddefense.com/

Trust: 0.6

sources: CNNVD: CNNVD-200609-205

SOURCES

db:	VULHUB	id:	VHN-19562
db:	BID	id:	19986
db:	JVNDB	id:	JVNDB-2006-002728
db:	PACKETSTORM	id:	50042
db:	PACKETSTORM	id:	50052
db:	PACKETSTORM	id:	50093
db:	CNNVD	id:	CNNVD-200609-205
db:	NVD	id:	CVE-2006-3454

LAST UPDATE DATE

2024-08-14T14:47:53.728000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-19562	date:	2018-10-18T00:00:00
db:	BID	id:	19986	date:	2016-07-05T21:38:00
db:	JVNDB	id:	JVNDB-2006-002728	date:	2012-12-20T00:00:00
db:	CNNVD	id:	CNNVD-200609-205	date:	2006-09-18T00:00:00
db:	NVD	id:	CVE-2006-3454	date:	2018-10-18T16:47:37.550

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-19562	date:	2006-09-14T00:00:00
db:	BID	id:	19986	date:	2006-09-13T00:00:00
db:	JVNDB	id:	JVNDB-2006-002728	date:	2012-12-20T00:00:00
db:	PACKETSTORM	id:	50042	date:	2006-09-14T22:28:53
db:	PACKETSTORM	id:	50052	date:	2006-09-14T23:06:11
db:	PACKETSTORM	id:	50093	date:	2006-09-16T06:52:54
db:	CNNVD	id:	CNNVD-200609-205	date:	2006-09-13T00:00:00
db:	NVD	id:	CVE-2006-3454	date:	2006-09-14T00:07:00