PT-2007-4252 · Symantec · System Works+2

Published 2007-08-09 · Updated 2017-07-29 · CVE-2007-2955

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Norton AntiVirus, Internet Security, and System Works products for 2006

Description The issue is related to input validation errors in multiple ActiveX controls in NavComUI.dll. This allows remote attackers to execute arbitrary code via the AnomalyList property to AxSysListView32 and the Anomaly property to AxSysListView32OAA.

Recommendations For Norton AntiVirus, Internet Security, and System Works products for 2006, consider disabling the ActiveX controls in NavComUI.dll as a temporary workaround until a patch is available. Restrict access to the AxSysListView32 and AxSysListView32OAA components to minimize the risk of exploitation. Avoid using the AnomalyList and Anomaly properties in the affected ActiveX controls until the issue is resolved.

Fix

Related Identifiers

CVE-2007-2955

Affected Products

Internet Security

Norton Antivirus

System Works

References · 10

• http://secunia.com/secunia_research/2007-53/advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2955 · Security Note
• http://securitytracker.com/id?1018547 · Note
• http://symantec.com/avcenter/security/Content/2007.08.09.html · Note
• http://vupen.com/english/advisories/2007/2822 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35944 · Note
• http://secunia.com/advisories/25215 · Note
• http://securitytracker.com/id?1018546 · Note
• http://securitytracker.com/id?1018545 · Note
• http://securityfocus.com/bid/24983 · Note