Symantec Multiple Products SymEvent Driver Local Denial of Service Vulnerability

Bugtraq ID:	20051
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-4855 CVE-2007-1495
Remote:	No
Local:	Yes
Published:	Sep 15 2006 12:00AM
Updated:	May 12 2015 07:49PM
Credit:	Discovery is credited to David Matousek.
Vulnerable:	Symantec pcAnywhere 11.5 Symantec Norton SystemWorks 2006 0 Symantec Norton SystemWorks 2005 Premier 0 Symantec Norton SystemWorks 2005 0 Symantec Norton SystemWorks 2004 Professional Edition Symantec Norton SystemWorks 2004 Symantec Norton SystemWorks 2003 Professional Edition Symantec Norton Personal Firewall 2006 Symantec Norton Personal Firewall 2005 Symantec Norton Personal Firewall 2004 Symantec Norton Personal Firewall 2003 Symantec Norton Internet Security 2007 0 Symantec Norton Internet Security 2006 Professional Edition Symantec Norton Internet Security 2005 Professional Edition Symantec Norton Internet Security 2005 Symantec Norton Internet Security 2004 Professional Edition Symantec Norton Internet Security 2004 Symantec Norton Internet Security 2003 Professional Edition Symantec Norton Internet Security 2003 Symantec Norton Antivirus 2007 0 Symantec Norton AntiVirus 2006 Symantec Norton AntiVirus 2005 Symantec Norton AntiVirus 2004 Professional Edition Symantec Norton AntiVirus 2004 Symantec Norton AntiVirus 2003 Professional Edition Symantec Norton Antivirus 2003 0 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Host IDS 0 Symantec Client Security 3.0 Symantec Client Security 2.0.5 build 1100 Symantec Client Security 2.0.3 MR3 b9.0.3.1000 Symantec Client Security 2.0.2 MR2 b9.0.2.1000 Symantec Client Security 2.0.1 MR1 b9.0.1.1000 Symantec Client Security 2.0 STM build 9.0.0.338 Symantec Client Security 2.0 (SCF 7.1) Symantec Client Security 2.0 Symantec Client Security 1.1.1 MR5 build 8.1.1.336 Symantec Client Security 1.1.1 MR4 build 8.1.1.329 Symantec Client Security 1.1.1 MR3 build 8.1.1.323 Symantec Client Security 1.1.1 MR2 build 8.1.1.319 Symantec Client Security 1.1.1 MR1 build 8.1.1.314a Symantec Client Security 1.1.1 build 393 Symantec Client Security 1.1.1 MR6 b8.1.1.266 Symantec Client Security 1.1.1 Symantec Client Security 1.1 STM b8.1.0.825a Symantec Client Security 1.1 Symantec Client Security 1.0.1 MR8 build 8.01.471 Symantec Client Security 1.0.1 MR7 build 8.01.464 Symantec Client Security 1.0.1 MR6 build 8.01.460 Symantec Client Security 1.0.1 MR5 build 8.01.457 Symantec Client Security 1.0.1 MR4 build 8.01.446 Symantec Client Security 1.0.1 MR3 build 8.01.434 Symantec Client Security 1.0.1 build 8.01.437 Symantec Client Security 1.0.1 MR9 b8.01.501 Symantec Client Security 1.0.1 MR2 b8.01.429c Symantec Client Security 1.0.1 MR1 b8.01.425a/b Symantec Client Security 1.0.1 Symantec Client Security 1.0 .0 b8.01.9378 Symantec Client Security 1.0 b8.01.9374 Symantec Client Security 1.0 Symantec Client Security 3.1 Symantec AntiVirus Corporate Edition 10.0.2 .2021 Symantec AntiVirus Corporate Edition 10.0.2 .2020 Symantec AntiVirus Corporate Edition 10.0.2 .2011 Symantec AntiVirus Corporate Edition 10.0.2 .2010 Symantec AntiVirus Corporate Edition 10.0.2 .2002 Symantec AntiVirus Corporate Edition 10.0.2 .2001 Symantec AntiVirus Corporate Edition 10.0.2 .2000 Symantec AntiVirus Corporate Edition 10.0 Symantec AntiVirus Corporate Edition 9.0.5 .1100 Symantec AntiVirus Corporate Edition 9.0.5 Symantec AntiVirus Corporate Edition 9.0.4 Symantec AntiVirus Corporate Edition 9.0.3 .1000 Symantec AntiVirus Corporate Edition 9.0.2 .1000 Symantec AntiVirus Corporate Edition 9.0.1 .1.1000 Symantec AntiVirus Corporate Edition 9.0 .0.338 Symantec AntiVirus Corporate Edition 9.0 Symantec AntiVirus Corporate Edition 8.1.1 build 8.1.1.329 Symantec AntiVirus Corporate Edition 8.1.1 build 8.1.1.323 Symantec AntiVirus Corporate Edition 8.1.1 build 8.1.1.319 Symantec AntiVirus Corporate Edition 8.1.1 build 8.1.1.314a Symantec AntiVirus Corporate Edition 8.1.1 build 393 Symantec AntiVirus Corporate Edition 8.1.1 .377 Symantec AntiVirus Corporate Edition 8.1.1 .366 Symantec AntiVirus Corporate Edition 8.1.1 Symantec AntiVirus Corporate Edition 8.1 build 8.01.471 Symantec AntiVirus Corporate Edition 8.1 build 8.01.464 Symantec AntiVirus Corporate Edition 8.1 build 8.01.460 Symantec AntiVirus Corporate Edition 8.1 build 8.01.457 Symantec AntiVirus Corporate Edition 8.1 build 8.01.446 Symantec AntiVirus Corporate Edition 8.1 build 8.01.437 Symantec AntiVirus Corporate Edition 8.1 build 8.01.434 Symantec AntiVirus Corporate Edition 8.1 .0.825a Symantec AntiVirus Corporate Edition 8.1 Symantec AntiVirus Corporate Edition 8.0 1.9378 Symantec AntiVirus Corporate Edition 8.0 1.9374 Symantec AntiVirus Corporate Edition 8.0 1.501 Symantec AntiVirus Corporate Edition 8.0 1.429c Symantec AntiVirus Corporate Edition 8.0 1.425a/b Symantec AntiVirus Corporate Edition 8.0 1 Symantec AntiVirus Corporate Edition 8.0 Symantec AntiVirus Corporate Edition 10.1
Not Vulnerable:

Symantec Multiple Products SymEvent Driver Local Denial of Service Vulnerability

Multiple Symantec products are prone to a local denial-of-service vulnerability. This issue occurs when attackers send malformed data to the 'SymEvent' driver.

A local authenticated attacker may exploit this issue to crash affected computers, denying service to legitimate users.

Please see the vulnerable systems section for details regarding affected Symantec products.

Symantec Multiple Products SymEvent Driver Local Denial of Service Vulnerability

The discoverer of this vulnerability has released an exploit:

• /data/vulnerabilities/exploits/BTP00011P002NF.zip

Symantec Multiple Products SymEvent Driver Local Denial of Service Vulnerability

Solution:
Symantec has released updates to address this issue. Please see the referenced advisory for information on obtaining and applying fixes.

Symantec Multiple Products SymEvent Driver Local Denial of Service Vulnerability

References:

• Norton Personal Firewall Homepage (Symantec)
  
• Symantec Advisory SYM06-018 (Symantec)
  
• Symantec Norton Insufficient validation of 'SymEvent' driver inp (David Matousek )