CVE-2007-1173

CVE-2007-1173 describes a buffer overflow flaw in the CentennialIPTransferServer (XFERWAN.EXE) used by Centennial Discovery 2006 Feature Pack 1, Numara Asset Manager 8.0, and Symantec Discovery 6.5. The vulnerability arises from processing long strings in crafted TCP packets, enabling remote arbi...

Symantec Norton Internet Security 2004 ISAlertDataCOM ActiveX control stack buffer overflow

Overview The Symantec Norton Internet Security 2004 ISAlertDataCOM ActiveX control contains a stack buffer overflow, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Symantec Norton Internet Security is a software package for Windows...

Symantec Norton Internet Security 2006 COM对象安全绕过漏洞

Norton Internet Security 2006是一款可以对反间谍软件，病毒，反垃圾，恶意网络通信进行保护的安全套件。 Norton Internet Security 2006安装的ActiveX控件存在设计错误，远程攻击者可以利用漏洞以应用程序进程权限执行任意代码。 Norton Internet Security 2006安装如下ActiveX控件注册为安全脚本： Progid: Symantec.Norton.AntiVirus.NAVOptions Clsid: 085ABFE2-D753-445C-8A2A-D4BD46CE0811 File: C:\Program...

Symantec Norton Internet Security Code Execution

Invalid processing of exceptional conditions allows to access ActiveX not makrked as safe for scripting...

iDefense Security Advisory 05.09.07: Symantec Norton Internet Security 2006 COM Object Security ByPass Vulnerability

Symantec Norton Internet Security 2006 COM Object Security ByPass Vulnerability iDefense Security Advisory 05.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ May 09, 2007 I. BACKGROUND Norton Internet Security 2006 is a comprehensive system security suite that offers protection from...

Memory corruption

Symantec pcAnywhere 11.5.x and 12.0.x retains unencrypted login credentials for the most recent login within process memory, which allows local administrators to obtain the credentials by reading process memory, a different vulnerability than CVE-2006-3785...

CVE-2007-2619

Symantec pcAnywhere 11.5.x and 12.0.x retains unencrypted login credentials for the most recent login within process memory, which allows local administrators to obtain the credentials by reading process memory, a different vulnerability than CVE-2006-3785...

CVE-2007-2619

CVE-2007-2619 affects Symantec pcAnywhere 11.5.x and 12.0.x, where unencrypted login credentials can reside in process memory. The description indicates local administrators can read memory to retrieve credentials, making this a local access issue. No explicit exploit details or mitigation are pr...

CVE-2007-2619

Symantec pcAnywhere 11.5.x and 12.0.x retains unencrypted login credentials for the most recent login within process memory, which allows local administrators to obtain the credentials by reading process memory, a different vulnerability than CVE-2006-3785...

CVE-2006-3456

The Symantec NAVOPTS.DLL ActiveX control aka Symantec.Norton.AntiVirus.NAVOptions 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via...

CVE-2006-3456

The Symantec NAVOPTS.DLL ActiveX control aka Symantec.Norton.AntiVirus.NAVOptions 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via...

CVE-2006-3456

CVE-2006-3456 concerns the Symantec NAVOPTS.DLL ActiveX control (NAVOptions) in Norton AntiVirus/Internet Security/System Works 2005–2006 (NAVOptions 12.2.0.13). The control, intended for application-embedded web browsers, can be loaded in a standard browser window, causing initialization errors ...

Norton Antivirus NAVOpts.dll ActiveX控件绕过安全限制漏洞

Symantec Norton AntiVirus是一款功能强大的反病毒程序。 Norton AntiVirus所带的ActiveX控件实现上存在漏洞，远程攻击者可能利用此漏洞绕过浏览器的安全限制。 Norton会安装以下ActiveX控件： Progid：Symantec.Norton.AntiVirus.NAVOptions Clsid：085ABFE2-D753-445C-8A2A-D4BD46CE0811 文件：C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVOpts.dll 版本：12.2.0.13...

Symantec pcAnywhere Remote User Credential Disclosure

SUMMARY Symantec pcAnywhere fails to properly protect remote user credentials stored in memory. Risk Impact Low Remote Access | No ---|--- Local Access | Yes Authentication Required | Yes Exploit publicly available | No AFFECTED PRODUCTS Products | Versions ---|--- Symantec pcAnywhere | 11.5.x No...

Symantec Norton Antivirus NAVOPTS.DLL ActiveX Control Remote Code Execution Vulnerability

Description Symantec Norton Antivirus ActiveX control is prone to a remote code-execution vulnerability. An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document. Successful exploits will allow attackers to execute arbitrary code in the context of th...

Symantec Products SupportSoft ActiveX Control Multiple Buffer Overflows (CVE-2006-6490)

Multiple vulnerabilities have been reported in Symantec SupportSoft ActiveX controls. SupportSoft provides third party ActiveX controls used for remote assistance and other technical support functions. A remote attacker could cause the browser to crash allowing execution of arbitrary commands.The...

CVE-2007-2375

The agent remote upgrade interface in Symantec Enterprise Security Manager ESM before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol...

Code injection

The agent remote upgrade interface in Symantec Enterprise Security Manager ESM before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol...

CVE-2007-2375

The CVE-2007-2375 issue affects Symantec Enterprise Security Manager (ESM) prior to 20070405, where the agent remote upgrade interface does not verify the authenticity of upgrades. This allows remote attackers to execute arbitrary code through software implementing the agent upgrade protocol. The...

CVE-2007-2375

The agent remote upgrade interface in Symantec Enterprise Security Manager ESM before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol...