PT-2006-6935 · Symantec · Symantec Livestate 7.1 Agent For Windows

Published 2006-12-06 · Updated 2024-08-07 · CVE-2006-6308

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec LiveState 7.1 Agent for Windows

Description The issue allows local users to potentially gain privileges by stopping the shstart.exe process and opening "Web Self-Service" from the system tray icon. This action opens a browser window running with elevated privileges. However, it is noted that administrator privileges may be necessary to terminate shstart.exe, which could negate the privilege escalation.

Recommendations For Symantec LiveState 7.1 Agent for Windows, consider restricting access to the system tray icon's "Web Self-Service" feature to prevent potential privilege escalation. Additionally, ensure that only authorized users have the ability to stop the shstart.exe process.

Fix

Related Identifiers

CVE-2006-6308

Affected Products

Symantec Livestate 7.1 Agent For Windows

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-6308 · Security Note
• http://securitytracker.com/id?1017332 · Note
• http://securityfocus.com/archive/1/453587/100/0/threaded · Note
• http://securityfocus.com/archive/1/453551/100/0/threaded · Note
• http://securityfocus.com/archive/1/453481/100/0/threaded · Note
• http://securityfocus.com/archive/1/453569/100/0/threaded · Note
• http://securityfocus.com/archive/1/453653/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30728 · Note