CERT-In Vulnerability Note CIVN-2006-41
Symantec AntiVirus and Client Security Remote Buffer Overflow Vulnerability

Original Issue Date: May 29, 2006
Updated: June 01, 2006

Severity Rating: High

Systems Affected

• Symantec Client Security version 3.1 (3.1.0.394)
• Symantec Client Security version 3.1 (3.1.0.400)
• Symantec Client Security version 3.1 (3.0.2.2010)
• Symantec Client Security version 3.1 (3.0.2.2020)
• Symantec Antivirus Corporate Edition version 10.1 (10.1.0.394)
• Symantec Antivirus Corporate Edition version 10.1 (10.1.0.400)
• Symantec Antivirus Corporate Edition version 10.1 (10.0.2.2010)
• Symantec Antivirus Corporate Edition version 10.1 (10.0.2.2020)

Overview

A stack overflow vulnerability has been reported in Symantec AntiVirus and Symantec Client Security which could be exploited remotely by an attacker to execute arbitrary commands with system level privileges on the affected system.

Description

A vulnerability has been reported in Symantec AntiVirus and Symantec Client Security which occurs due to stack based buffer overflow condition while processing specially crafted malicious files. The vulnerability could be exploited by local as well as remote attacker to execute arbitrary code with system level privileges on the affected system. This could possibly lead to complete control of an affected system by the attacker . Further the vulnerability could be exploited without user interaction as well.

Solution

Apply appropriate patches as mentioned in http://www.symantec.com/techsupp/enterprise/select_
product_updates.html

Vendor Information

SYMANTEC
Symantec Advisory :
SYM06-010

References

eEye- Digital security http://www.eeye.com/html/research/upcoming/20060524.html

FrSIRT
http://www.frsirt.com/english/advisories/2006/2005

US-CERT
VU#404910

Security Tracker
http://securitytracker.com/id?1016162

Security Focus
http://www.securityfocus.com/bid/18107/

Revisions:
June 01, 2006: References, CVE Name.

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Phone: +91 11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003