PT-2006-3976 · Symantec · Symantec Security Information Manager

Published 2006-06-19 · Updated 2017-07-20 · CVE-2006-3072

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Security Information Manager versions prior to 4.0.2.29 HOTFIX 1

Description The issue allows local users to execute arbitrary commands by crafting "rule definitions" that produce dangerous Java code during M4 transformation.

Recommendations For versions prior to 4.0.2.29 HOTFIX 1, update to version 4.0.2.29 HOTFIX 1 to resolve the issue. As a temporary workaround, consider restricting access to the M4 Macro Library to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-3072

Affected Products

Symantec Security Information Manager

References · 7

• http://securitytracker.com/id?1016296 · Patch
• http://secunia.com/advisories/20647 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3072 · Security Note
• http://securityresponse.symantec.com/avcenter/security/Content/2006.06.13b.html · Note
• http://vupen.com/english/advisories/2006/2334 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27105 · Note
• http://securityfocus.com/bid/18420 · Note