Vulnerability CVE-2006-1836


Published: 2006-04-19   Modified: 2012-02-12

Description:
Untrusted search path vulnerability in unspecified components in Symantec LiveUpdate for Macintosh 3.0.0 through 3.5.0 do not set the execution path, which allows local users to gain privileges via a Trojan horse program.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Symantec Norton AntiVirus LiveUpdate Local Privilege Escalation
DigitalMunition....
21.10.2005

Type:

CWE-Other

Vendor: Symantec
Product: Norton antivirus 
Version:
9.0.3
9.0.2
9.0.1
9.0.0
10.9.1
10.0.1
10.0.0
10.0
Product: Norton utilities 
Version: 8.0;
Product: Liveupdate 
Version:
3.5
3.0.3
3.0.2
3.0.1
3.0
Product: Norton personal firewall 
Version: 3.1; 3.0;
Product: Norton system works 
Version: 3.0;
Product: Norton internet security 
Version: 3.0;

CVSS2 => (AV:L/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
10/10
3.1/10
Exploit range
Attack complexity
Authentication
Local
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://securityreason.com/securityalert/100
http://securityresponse.symantec.com/avcenter/security/Content/2006.04.17b.html
http://securitytracker.com/id?1015953
http://www.securityfocus.com/archive/1/431318/100/0/threaded
http://www.securityfocus.com/bid/17571
http://www.vupen.com/english/advisories/2006/1386
https://exchange.xforce.ibmcloud.com/vulnerabilities/25839

Related CVE
CVE-2018-18367
Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution ...
CVE-2018-18366
Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22, SEP-12.1.7484.7002 and SEP Cloud prior to 22.16.3 may be susceptibl...
CVE-2018-12244
SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula injection) vulnerability, which is a type of issue whereby an application or website allows untrusted input in...
CVE-2018-18369
Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when ...
CVE-2019-9694
Symantec Endpoint Encryption prior to SEE 11.2.1 MP1 may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that...
CVE-2019-9696
Symantec VIP Enterprise Gateway (all versions) may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting v...
CVE-2018-18364
Symantec Ghost Solution Suite (GSS) versions prior to 3.3 RU1 may be susceptible to a DLL hijacking vulnerability, which is a type of issue whereby a potential attacker attempts to execute unexpected code on your machine. This occurs via placement of...
CVE-2018-12245
Symantec Endpoint Protection prior to 14.2 MP1 may be susceptible to a DLL Preloading vulnerability, which in this case is an issue that can occur when an application being installed unintentionally loads a DLL provided by a potential attacker. Note ...

Copyright 2019, cxsecurity.com

 

Back to Top