Design/Logic Flaw

Aclient in Symantec Altiris Deployment Solution 6 before 6.8 SP2 6.8.378 allows local users to gain local System privileges via the Log File Viewer...

CVE-2007-4380

Aclient in Symantec Altiris Deployment Solution 6 before 6.8 SP2 6.8.378 allows local users to gain local System privileges via the Log File Viewer...

CVE-2007-4380

CVE-2007-4380 affects Symantec Altiris Deployment Solution 6.x prior to 6.8 SP2 (build 6.8.378) where the Aclient Log File Viewer enables local users to gain SYSTEM privileges. The vulnerability is described as a local privilege escalation via the Log File Viewer in the Altiris client (aclient). ...

Symantec Enterprise Firewall and Symantec Gateway Security Username Enumeration

SUMMARY Symantec Enterprise Firewall username information can be verified through an exposure in the login interface. Severity Low Remote Access | Yes ---|--- Local Access | No Authentication Required | No Exploit publicly available | No AFFECTED PRODUCTS Product | Version | Build | Solutions...

symantec-xss.txt

http://www.symantec.com/en/id/smb/products/trialware.jsp?pcid=%22%3E%3C% 69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A//c99%2eclpwn%2eco%6D%2F% 68%6D%2E%68%74%6D%3E&pvid=bewinsvr Tõnu...

Altiris Deployment Solution Elevation of Privilege

SUMMARY Symantecs Altiris Deployment Solution is vulnerable to an elevation of privilege attack. Severity Medium Remote Access | No ---|--- Local Access | Yes Authentication Required | Yes Exploit publicly available | No AFFECTED PRODUCTS Product | Version | Build | Solutions ---|---|---|---...

Symantec Discovery Insecure File Permissions

SUMMARY Insecure default directory and file permissions may allow local users to gain escalated privileges. Severity Low Remote Access | Local network access required ---|--- Local Access | Yes Authentication Required | Yes Exploit publicly available | No AFFECTED PRODUCTS Affected Products Produ...

CVE-2007-2950

Centennial Discovery 2006 Feature Pack 1, which is used by 1 Numara Asset Manager 8.0 and 2 Symantec Discovery 6.5, uses insecure permissions on certain directories, which allows local users to gain privileges...

CVE-2007-2950

CVE-2007-2950 involves Centennial Discovery 2006 Feature Pack 1 (used by Numara Asset Manager 8.0 and Symantec Discovery 6.5) where insecure default directory/file permissions enable local non-privileged users to gain privileges. The Symantec advisory notes the vulnerability arises from improper ...

CVE-2007-2950

Centennial Discovery 2006 Feature Pack 1, which is used by 1 Numara Asset Manager 8.0 and 2 Symantec Discovery 6.5, uses insecure permissions on certain directories, which allows local users to gain privileges...

SYMSA-2007-006: Citrix EPA ActiveX Control Design Flaw

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Symantec Vulnerability Research http://www.symantec.com/research Security Advisory Advisory ID: SYMSA-2007-006 Advisory Title: Citrix EPA ActiveX Control Design Flaw Author: Michael White / [email protected] Release Date: 19-07-2007 Applicatio...

Symantec SAVCE RTVScan Component Local Privilege Escalation (SYM07-017)

The remote installation of Symantec Antivirus Corporate Edition SAVCE or Symantec Client Security contains a flaw in the Real-Time scanner RTVScan component because it fails to drop its privileges with in a threat notification window. A local attacker may be able to leverage this flaw to elevate...

symtdi. sys local privilege elevation vulnerability-vulnerability warning-the black bar safety net

The recent adoption of the disassembly analysis found a symantec of the vulnerability, this vulnerability is in symtdi.sys in the presence of, by the To the driver in the processing IRPMJDEVICECONTROL routine does not check the user passed a buffer address of legitimacy, Cause any kernel address ...

Symantec AntiVirus畸形CAB和RAR文件解压堆溢出及拒绝服务漏洞

BUGTRAQ ID: 24282 CVECAN ID: CVE-2007-3699,CVE-2007-0447 Symantec AntiVirus是非常流行的杀毒解决方案。 Symantec AntiVirus没有正确地处理RAR文件头中的伪造PACKSIZE字段；如果将该字段设置为特定值的话，则扫描器在处理该文件时就可能触发死循环，导致拒绝服务。 Symantec AntiVirus引擎在扫描多个恶意格式的CAB文档时还存在堆溢出漏洞，如果用户受骗打开了特制的CAB文件的话就可能导致执行任意指令。 Symantec AntiVirus Scan Engine = 4.3.12...

CVE-2007-3800

Unspecified vulnerability in the Real-time scanner RTVScan component in Symantec AntiVirus Corporate Edition 9.0 through 10.1 and Client Security 2.0 through 3.1, when the Notification Message window is enabled, allows local users to gain privileges via crafted code...

Code injection

Unspecified vulnerability in the Real-time scanner RTVScan component in Symantec AntiVirus Corporate Edition 9.0 through 10.1 and Client Security 2.0 through 3.1, when the Notification Message window is enabled, allows local users to gain privileges via crafted code...

CVE-2007-3800

Unspecified vulnerability in the Real-time scanner RTVScan component in Symantec AntiVirus Corporate Edition 9.0 through 10.1 and Client Security 2.0 through 3.1, when the Notification Message window is enabled, allows local users to gain privileges via crafted code...

CVE-2007-3800

Summary : CVE-2007-3800 affects Symantec Antivirus Corporate Edition (9.0–10.1) and Symantec Client Security (2.0–3.1). The vulnerability lies in the Real-Time scanner RTVScan component where, if the Notification Message window is enabled, a local attacker can craft code to gain privileges. The c...

Stack overflow

Stack-based buffer overflow in the Internet E-mail Auto-Protect feature in Symantec AntiVirus Corporate Edition before 10.1, and Client Security before 3.1, allows local users to cause a denial of service service crash via a long 1 To, 2 From, or 3 Subject header in an outbound SMTP e-mail messag...

CVE-2007-3771

Stack-based buffer overflow in the Internet E-mail Auto-Protect feature in Symantec AntiVirus Corporate Edition before 10.1, and Client Security before 3.1, allows local users to cause a denial of service service crash via a long 1 To, 2 From, or 3 Subject header in an outbound SMTP e-mail messag...