Unscored severity · published May 11, 2007
CVE-2006-3456
The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is…
–
CVSS
3.9%
EPSS
No
On KEV
Description
The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via unspecified vectors related to content on a web site, and place Internet Explorer into a "defunct state" in which remote attackers can execute arbitrary code in addition to other Symantec ActiveX controls, regardless of whether they are marked safe for scripting. NOTE: this CVE was inadvertently used for an E-mail Auto-Protect issue, but that issue has been assigned CVE-2007-3771.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Norton Antivirus · Symantec
2005; 2006 · source: NVD
NI
Norton Internet Security · Symantec
2005; 2006 · source: NVD
NS
Norton System Works · Symantec
2005; 2006 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3456
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3456
Vendor Advisory
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529
osvdb.org
http://osvdb.org/35075
Vendor Advisory
http://secunia.com/advisories/25172
www.securityfocus.com
http://www.securityfocus.com/bid/23822
www.securitytracker.com
http://www.securitytracker.com/id?1018031
Vendor Advisory
http://www.symantec.com/avcenter/security/Content/2007.05.09.html
More from Norton Antivirus
9.8
CVE-2016-3645
Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through…
8.4
CVE-2016-3646
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec…
8.4
CVE-2016-3644
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec…
8.4
CVE-2016-2207
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec…
7.8
CVE-2016-5311
A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security,…