Login Request a demo
Unscored severity · published Sep 14, 2006
CVE-2006-3454
Multiple format string vulnerabilities in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security 1.x up to 3.0, allow local users to execute arbitrary code via…
–
CVSS
0.5%
EPSS
No
On KEV
Description
Multiple format string vulnerabilities in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security 1.x up to 3.0, allow local users to execute arbitrary code via format strings in (1) Tamper Protection and (2) Virus Alert Notification messages.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Client Security · Symantec
1.0; 1.0.1; 1.1; 1.1.1; 2.0; 2.0.1; +4 more · source: NVD
NA
Norton Antivirus · Symantec
8.1; 9.0; 9.0.1; 9.0.2; 10.0 · source: NVD
Affected product
CS
Client Security
Symantec
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3454
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3454
layereddefense.com
http://layereddefense.com/SAV13SEPT.html
secunia.com
http://secunia.com/advisories/21884
Patch
http://securityresponse.symantec.com/avcenter/security/Content/2006.09.13.html
securitytracker.com
http://securitytracker.com/id?1016842
www.securityfocus.com
http://www.securityfocus.com/archive/1/446041/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/446293/100/0/threaded
More from Client Security
–
CVE-2010-0107
Buffer overflow in an ActiveX control (SYMLTCOM.dll) in Symantec N360 1.0 and 2.0; Norton Internet Security, AntiVirus, SystemWorks, and Confidential 2006 through 2008; and…
–
CVE-2010-0108
Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVirus 10.0.x, 10.1.x before MR9, and 10.2.x before MR4; and…
–
CVE-2010-0106
The on-demand scanning in Symantec AntiVirus 10.0.x and 10.1.x before MR9, AntiVirus 10.2.x, and Client Security 3.0.x and 3.1.x before MR9, when Tamper protection is disabled,…
–
CVE-2009-3104
Unspecified vulnerability in Symantec Norton AntiVirus 2005 through 2008; Norton Internet Security 2005 through 2008; AntiVirus Corporate Edition 9.0 before MR7, 10.0, 10.1 before…
–
CVE-2009-1432
Symantec Reporting Server, as used in Symantec AntiVirus (SAV) Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Client Security (SCS) before 3.1 MR8, and…