PT-2001-2242 · Symantec · Norton Antivirus

Published 2001-09-07 · Updated 2020-04-02 · CVE-2001-1099

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Norton AntiVirus for Microsoft Exchange 2000 versions 2.x

Description The default configuration of the software allows remote attackers to identify the recipient's INBOX file path by sending an email with an attachment containing malicious content. This malicious content includes the path in the rejection notice, potentially exposing sensitive information.

Recommendations For versions 2.x, consider reconfiguring the software to prevent it from including the INBOX file path in rejection notices for emails with malicious attachments. As a temporary workaround, restrict access to the email system to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2001-1099

Affected Products

Norton Antivirus

References · 6

• http://securityfocus.com/archive/1/213762 · Vendor Advisory
• http://securityfocus.com/archive/1/212724 · Vendor Advisory
• http://securityfocus.com/bid/3305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1099 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7093 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1099 · Note