PT-2006-6122 · Symantec · System Works+3

John Heasman · Published 2006-10-19 · Updated 2017-07-20 · CVE-2006-5403

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Automated Support Assistant versions used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006

Description A stack-based buffer overflow issue exists in an ActiveX control used by the Symantec Automated Support Assistant. This could allow user-assisted remote attackers to cause a denial of service, potentially leading to a crash, and may also enable the execution of arbitrary code. The attack vectors for this issue are not specified.

Recommendations For Symantec Automated Support Assistant versions used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, consider disabling the affected ActiveX control as a temporary workaround until a patch is available. Restrict access to the vulnerable ActiveX control to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-5403

Affected Products

Internet Security

Norton Antivirus

Symantec Automated Support Assistant

System Works

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2006-5403 · Security Note
• http://secunia.com/advisories/22228 · Vendor Advisory
• http://vupen.com/english/advisories/2006/3929 · Note
• http://securitytracker.com/id?1016990 · Note
• http://securitytracker.com/id?1016988 · Note
• http://securitytracker.com/id?1016991 · Note
• http://kb.cert.org/vuls/id/400601 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29363 · Note
• http://securityresponse.symantec.com/avcenter/security/Content/2006.10.05.html · Note
• http://securitytracker.com/id?1016989 · Note
• http://securityfocus.com/bid/20348 · Note