High severity · published Jan 9, 2020
CVE-2016-5311
A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security,…
7.8
CVSS
0.7%
EPSS
No
On KEV
Description
A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security, Norton 360, Endpoint Protection Small Business Edition Cloud, and Endpoint Protection Cloud Client due to a DLL-preloading without path restrictions, which could let a local malicious user obtain system privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Endpoint Protection · Symantec
before 22.8.0.50 · source: NVD
EP
Endpoint Protection Cloud · Symantec
before 22.8.0.50 · source: NVD
N3
Norton 360 · Symantec
before 22.7 · source: NVD
NA
Norton Antivirus · Symantec
before 22.7 · source: NVD
NA
Norton Antivirus With Backup · Symantec
before 22.7 · source: NVD
NF
Norton Family · Symantec
before 22.7 · source: NVD
NI
Norton Internet Security · Symantec
before 22.7 · source: NVD
NS
Norton Security · Symantec
before 22.7 · source: NVD
NS
Norton Security With Backup · Symantec
before 22.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5311
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5311
Third Party Advisory
http://www.securityfocus.com/bid/94295
Third Party Advisory
http://www.securitytracker.com/id/1037323
Third Party Advisory
http://www.securitytracker.com/id/1037324
Third Party Advisory
http://www.securitytracker.com/id/1037325
Vendor Advisory
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20161117_00
More from Endpoint Protection
9.8
CVE-2016-3645
Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through…
8.8
CVE-2018-5237
Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain…
8.4
CVE-2016-3646
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec…
8.4
CVE-2016-3644
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec…
8.4
CVE-2016-2207
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec…