PT-2012-5686 · Symantec · Symantec Scan Engine+3

Will Dormann · Published 2012-11-14 · Updated 2013-03-12 · CVE-2012-4953

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions 11.0 Symantec Endpoint Protection Small Business Edition version 12.0 Symantec AntiVirus Corporate Edition versions 10.x Symantec Scan Engine versions prior to 5.2.8

Description The issue is related to the decomposer engine not properly performing bounds checks of the contents of CAB archives. This can be exploited by remote attackers using a crafted file, potentially leading to a denial of service or the execution of arbitrary code.

Recommendations For Symantec Endpoint Protection version 11.0, update to a version that includes the fix for this issue. For Symantec Endpoint Protection Small Business Edition version 12.0, update to a version that includes the fix for this issue. For Symantec AntiVirus Corporate Edition versions 10.x, update to a version that includes the fix for this issue. For Symantec Scan Engine versions prior to 5.2.8, update to version 5.2.8 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-4953

Affected Products

Symantec Antivirus Corporate Edition

Symantec Endpoint Protection

Symantec Endpoint Protection Small Business Edition

Symantec Scan Engine

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2012-4953 · Security Note
• http://kb.cert.org/vuls/id/985625 · Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121107_00 · Note
• http://securitytracker.com/id?1027726 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4953 · Note
• http://securityfocus.com/bid/56399 · Note