Unscored severity · published Apr 2, 2007
CVE-2007-1793
SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows…
–
CVSS
1.7%
EPSS
No
On KEV
Description
SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service (crash) or possibly execute arbitrary code via crafted arguments to the (1) NtCreateMutant and (2) NtOpenEvent functions. NOTE: it was later reported that Norton Internet Security 2008 15.0.0.60, and possibly other versions back to 2006, are also affected.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Antivirus · Symantec
10.0; 10.0.1; 10.0.1.1; 10.0.2; 10.0.2.1; 10.0.2.2; +7 more · source: NVD
CS
Client Security · Symantec
3.0; 3.0.0.359; 3.0.1.1000; 3.0.1.1001; 3.0.1.1007; 3.0.1.1008; +16 more · source: NVD
N3
Norton 360 · Symantec
1.0 · source: NVD
NA
Norton Antispam · Symantec
2004; 2005 · source: NVD
NA
Norton Antivirus · Symantec
2004; 2005; 2006; 2007; 2008 · source: NVD
NI
Norton Internet Security · Symantec
2004; 2005; 2006; 2007; 2008 · source: NVD
NP
Norton Personal Firewall · Symantec
2004; 2005; 2006; 2006_9.1.0.33; 2006_9.1.1.7 · source: NVD
NS
Norton System Works · Symantec
2004; 2005; 2006 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1793
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1793
osvdb.org
http://osvdb.org/34692
Vendor Advisory
http://secunia.com/advisories/24677
securityresponse.symantec.com
http://securityresponse.symantec.com/avcenter/security/Content/2008.12.12.html
Vendor Advisory
http://www.matousec.com/info/advisories/Norton-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php
www.matousec.com
http://www.matousec.com/info/advisories/plague-in-security-software-drivers.php
www.matousec.com
http://www.matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php
More from Antivirus
–
CVE-2012-4953
The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVirus Corporate Edition (SAVCE) 10.x, and…
–
CVE-2011-0688
Intel Alert Management System (aka AMS or AMS2), as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec…
–
CVE-2010-0111
HDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate…
–
CVE-2010-0110
Multiple stack-based buffer overflows in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec…
–
CVE-2010-3268
The GetStringAMSHandler function in prgxhndl.dll in hndlrsvc.exe in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (AMS), as…