PT-2007-1162 · Symantec+1 · Symantec Norton Antivirus+1

Published 2007-05-11 · Updated 2017-07-20 · CVE-2006-3456

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Symantec Norton AntiVirus versions 12.2.0.13

Description: The Symantec NAVOPTS.DLL ActiveX control is vulnerable to an issue that allows remote attackers to crash the control via unspecified vectors related to content on a web site. This can place Internet Explorer into a defunct state, allowing remote attackers to execute arbitrary code in addition to other Symantec ActiveX controls, regardless of whether they are marked safe for scripting.

Recommendations: For Symantec Norton AntiVirus version 12.2.0.13, consider disabling the NAVOPTS.DLL ActiveX control until a patch is available to prevent potential exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-3456

Affected Products

Internet Explorer

Symantec Norton Antivirus

References · 9

• http://vupen.com/english/advisories/2007/1751 · Vendor Advisory
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529 · Vendor Advisory
• http://secunia.com/advisories/25172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3456 · Security Note
• http://symantec.com/avcenter/security/Content/2007.05.09.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34200 · Note
• http://securitytracker.com/id?1018031 · Note
• http://osvdb.org/35075 · Note
• http://securityfocus.com/bid/23822 · Note