PT-2006-5609 · Symantec · Symantec Ghost+7

David Matousek · Published 2006-09-19 · Updated 2018-10-17 · CVE-2006-4855

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Symantec Norton Personal Firewall versions 9.1.0.33 and other versions Symantec Internet Security (affected versions not specified) Symantec AntiVirus (affected versions not specified) Symantec SystemWorks (affected versions not specified) Symantec Client Security SCS versions 1.x through 3.1 Symantec AntiVirus Corporate Edition SAVCE versions 8.x through 10.1 Symantec pcAnywhere version 11.5 Symantec Host (affected versions not specified)

Description The issue allows local users to cause a denial of service, resulting in a system crash, by sending invalid data. This can be achieved by calling DeviceIoControl to send the data.

Recommendations For Symantec Norton Personal Firewall version 9.1.0.33, update to a version that fixes the issue. For Symantec Internet Security, update to a version that fixes the issue. For Symantec AntiVirus, update to a version that fixes the issue. For Symantec SystemWorks, update to a version that fixes the issue. For Symantec Client Security SCS versions 1.x through 3.1, update to a version later than 3.1. For Symantec AntiVirus Corporate Edition SAVCE versions 8.x through 10.1, update to a version later than 10.1. For Symantec pcAnywhere version 11.5, update to a version that fixes the issue. For Symantec Host, update to a version that fixes the issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2006-4855

Affected Products

Symantec Antivirus

Symantec Antivirus Corporate Edition

Symantec Client Security

Symantec Ghost

Symantec Internet Security

Symantec Norton Personal Firewall

Symantec System Works

Symantec Pcanywhere

References · 19

• 🔥 https://exploit-db.com/exploits/28588 · Exploit
• 🔥 http://securityfocus.com/bid/20051 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4855 · Security Note
• http://vupen.com/english/advisories/2006/3636 · Vendor Advisory
• http://matousec.com/info/advisories/Norton-Insufficient-validation-of-SymEvent-driver-input-buffer.php · Vendor Advisory
• http://secunia.com/advisories/21938 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4855 · Note
• http://securitytracker.com/id?1016892 · Note
• http://securitytracker.com/id?1016895 · Note
• http://securitytracker.com/id?1016893 · Note
• http://securitytracker.com/id?1016889 · Note
• http://securityfocus.com/archive/1/446111/100/0/threaded · Note
• http://securityreason.com/securityalert/1591 · Note
• http://securitytracker.com/id?1016896 · Note
• http://securitytracker.com/id?1016897 · Note