PT-2001-2242 · Symantec · Norton Antivirus

Publicado 2001-09-07 · Atualizado 2020-04-02 · CVE-2001-1099

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Norton AntiVirus for Microsoft Exchange 2000 versions 2.x

Description The default configuration of the software allows remote attackers to identify the recipient's INBOX file path by sending an email with an attachment containing malicious content. This malicious content includes the path in the rejection notice, potentially exposing sensitive information.

Recommendations For versions 2.x, consider reconfiguring the software to prevent it from including the INBOX file path in rejection notices for emails with malicious attachments. As a temporary workaround, restrict access to the email system to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2001-1099

Produtos afetados

Norton Antivirus

Referências · 6

• http://securityfocus.com/archive/1/213762 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7093 · Nota
• http://securityfocus.com/archive/1/212724 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1099 · Nota
• http://securityfocus.com/bid/3305 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-1099 · Nota de Segurança