Unscored severity · published Apr 25, 2006
CVE-2006-0230
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator…
–
CVSS
16.5%
EPSS
No
On KEV
Description
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator privileges via a modified client that sends certain XML requests.
Exploitation
Is it being used?
Exploit prediction (EPSS)16.5% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Antivirus Scan Engine · Symantec
5.0.0.24 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0230
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0230
Exploit
http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0010.html
secunia.com
http://secunia.com/advisories/19734
US Government Resource
http://www.kb.cert.org/vuls/id/118388
www.securityfocus.com
http://www.securityfocus.com/archive/1/431724/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/431734/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/17637
More from Antivirus Scan Engine
7.0
CVE-2004-0217
The LiveUpdate capability (liveupdate.sh) in Symantec AntiVirus Scan Engine 4.0 and 4.3 for Red Hat Linux allows local users to create or append to arbitrary files via a symlink…
–
CVE-2007-3699
The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite loop) via a certain value in the PACK_SIZE field of a RAR…
–
CVE-2007-0447
Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives
–
CVE-2006-0231
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct…
–
CVE-2006-0232
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control,…