PT-2006-5076 · Symantec · Symantec Norton Personal Firewall

David Matousek · Published 2006-08-21 · Updated 2018-10-17 · CVE-2006-4266

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symantec Norton Personal Firewall 2006 version 9.1.0.33 and possibly earlier

Description The issue allows local users to provide Trojan horse libraries by modifying the HKLMSOFTWARESymantecCCPDSuiteOwners registry key using RegSaveKey and RegRestoreKey, as demonstrated with NISProd.dll. This attack typically requires administrative privileges and does not cross privilege boundaries. However, it is considered a vulnerability because the product is intended to protect against such privileged actions.

Recommendations For Symantec Norton Personal Firewall 2006 version 9.1.0.33 and possibly earlier, consider restricting access to the HKLMSOFTWARESymantecCCPDSuiteOwners registry key to prevent unauthorized modifications. Additionally, as a temporary workaround, consider disabling the use of RegSaveKey and RegRestoreKey functions to modify this key until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-4266

Affected Products

Symantec Norton Personal Firewall

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-4266 · Security Note
• http://securityfocus.com/bid/19585 · Note
• http://securityfocus.com/archive/1/443632/100/0/threaded · Note
• http://securityreason.com/securityalert/1428 · Note
• http://matousec.com/info/advisories/Norton-DLL-faking-via-SuiteOwners-protection-bypass.php · Note