var-200610-0183
Vulnerability from variot
Unspecified vulnerability in an ActiveX control used in Symantec Automated Support Assistant, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, allows user-assisted remote attackers to obtain sensitive information via unspecified vectors. This vulnerability requires a certain amount of user-interaction for an attack to occur, such as visiting a malicious website. A successful exploit would let a remote attacker execute code with the privileges of the currently logged-in user. Therefore, the affected control may be present on computers running other consumer products and versions as well. Symantec Corporate and Enterprise products are not affected, because they do not install the affected control.
Want to work within IT-Security?
Secunia is expanding its team of highly skilled security experts. We will help with relocation and obtaining a work permit.
1) An unspecified input validation error exists, which can be exploited to gain unauthorized access to system information.
Successful exploitation requires spoofing of a trusted domain web site and to trick the user to click on a malicious link.
Automated Support Assistant: Update to the latest version. https://www-secure.symantec.com/techsupp/asa/install.jsp
PROVIDED AND/OR DISCOVERED BY: The vendor credits John Haesman, Next Generation Security Research.
ORIGINAL ADVISORY: http://securityresponse.symantec.com/avcenter/security/Content/2006.10.05.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-200610-0183", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "norton system works", "scope": "eq", "trust": 1.6, "vendor": "symantec", "version": "2006" }, { "model": "norton system works", "scope": "eq", "trust": 1.6, "vendor": "symantec", "version": "2005" }, { "model": "norton internet security", "scope": "eq", "trust": 1.6, "vendor": "symantec", "version": "2006" }, { "model": "automated support assistant", "scope": null, "trust": 1.4, "vendor": "symantec", "version": null }, { "model": "norton antivirus", "scope": null, "trust": 1.4, "vendor": "symantec", "version": null }, { "model": "norton antivirus", "scope": "eq", "trust": 1.0, "vendor": "symantec", "version": "*" }, { "model": "automated support assistant", "scope": "eq", "trust": 1.0, "vendor": "symantec", "version": "*" }, { "model": null, "scope": null, "trust": 0.8, "vendor": "symantec", "version": null }, { "model": "norton internet security", "scope": null, "trust": 0.8, "vendor": "symantec", "version": null }, { "model": "norton systemworks", "scope": "eq", "trust": 0.8, "vendor": "symantec", "version": "2005 and 2006" }, { "model": "norton systemworks", "scope": "eq", "trust": 0.3, "vendor": "symantec", "version": "20060" }, { "model": "norton systemworks", "scope": "eq", "trust": 0.3, "vendor": "symantec", "version": "20050" }, { "model": "norton internet security", "scope": "eq", "trust": 0.3, "vendor": "symantec", "version": "20060" }, { "model": "norton internet security", "scope": "eq", "trust": 0.3, "vendor": "symantec", "version": "2005" }, { "model": "norton antivirus", "scope": "eq", "trust": 0.3, "vendor": "symantec", "version": "2006" }, { "model": "norton antivirus", "scope": "eq", "trust": 0.3, "vendor": "symantec", "version": "2005" }, { "model": "automated support assistant", "scope": "eq", "trust": 0.3, "vendor": "symantec", "version": "0" } ], "sources": [ { "db": "CERT/CC", "id": "VU#400601" }, { "db": "BID", "id": "20348" }, { "db": "JVNDB", "id": "JVNDB-2006-003319" }, { "db": "NVD", "id": "CVE-2006-5404" }, { "db": "CNNVD", "id": "CNNVD-200610-316" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:symantec:norton_internet_security:2006:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:symantec:norton_system_works:2005:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:symantec:automated_support_assistant:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:symantec:norton_antivirus:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:symantec:norton_system_works:2006:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2006-5404" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "John Haesman", "sources": [ { "db": "CNNVD", "id": "CNNVD-200610-316" } ], "trust": 0.6 }, "cve": "CVE-2006-5404", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 4.9, "impactScore": 2.9, "integrityImpact": "NONE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "trust": 1.0, "userInteractionRequired": true, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "High", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "None", "baseScore": 2.6, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "CVE-2006-5404", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Low", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0" }, { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 4.9, "id": "VHN-21512", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "LOW", "trust": 0.1, "vectorString": "AV:N/AC:H/AU:N/C:P/I:N/A:N", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "NVD", "id": "CVE-2006-5404", "trust": 1.8, "value": "LOW" }, { "author": "CARNEGIE MELLON", "id": "VU#400601", "trust": 0.8, "value": "1.16" }, { "author": "CNNVD", "id": "CNNVD-200610-316", "trust": 0.6, "value": "LOW" }, { "author": "VULHUB", "id": "VHN-21512", "trust": 0.1, "value": "LOW" } ] } ], "sources": [ { "db": "CERT/CC", "id": "VU#400601" }, { "db": "VULHUB", "id": "VHN-21512" }, { "db": "JVNDB", "id": "JVNDB-2006-003319" }, { "db": "NVD", "id": "CVE-2006-5404" }, { "db": "CNNVD", "id": "CNNVD-200610-316" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Unspecified vulnerability in an ActiveX control used in Symantec Automated Support Assistant, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, allows user-assisted remote attackers to obtain sensitive information via unspecified vectors. This vulnerability requires a certain amount of user-interaction for an attack to occur, such as visiting a malicious website. A successful exploit would let a remote attacker execute code with the privileges of the currently logged-in user. Therefore, the affected control may be present on computers running other consumer products and versions as well. Symantec Corporate and Enterprise products are not affected, because they do not install the affected control. \n\n----------------------------------------------------------------------\n\nWant to work within IT-Security?\n\nSecunia is expanding its team of highly skilled security experts. \nWe will help with relocation and obtaining a work permit. \n\n1) An unspecified input validation error exists, which can be\nexploited to gain unauthorized access to system information. \n\nSuccessful exploitation requires spoofing of a trusted domain web\nsite and to trick the user to click on a malicious link. \n\nAutomated Support Assistant:\nUpdate to the latest version. \nhttps://www-secure.symantec.com/techsupp/asa/install.jsp\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits John Haesman, Next Generation Security Research. \n\nORIGINAL ADVISORY:\nhttp://securityresponse.symantec.com/avcenter/security/Content/2006.10.05.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n", "sources": [ { "db": "NVD", "id": "CVE-2006-5404" }, { "db": "CERT/CC", "id": "VU#400601" }, { "db": "JVNDB", "id": "JVNDB-2006-003319" }, { "db": "BID", "id": "20348" }, { "db": "VULHUB", "id": "VHN-21512" }, { "db": "PACKETSTORM", "id": "50672" } ], "trust": 2.79 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "BID", "id": "20348", "trust": 2.8 }, { "db": "SECUNIA", "id": "22228", "trust": 2.6 }, { "db": "SECTRACK", "id": "1016988", "trust": 2.5 }, { "db": "SECTRACK", "id": "1016989", "trust": 2.5 }, { "db": "SECTRACK", "id": "1016990", "trust": 2.5 }, { "db": "SECTRACK", "id": "1016991", "trust": 2.5 }, { "db": "NVD", "id": "CVE-2006-5404", "trust": 2.5 }, { "db": "VUPEN", "id": "ADV-2006-3929", "trust": 1.7 }, { "db": "CERT/CC", "id": "VU#400601", "trust": 1.1 }, { "db": "JVNDB", "id": "JVNDB-2006-003319", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-200610-316", "trust": 0.7 }, { "db": "XF", "id": "29366", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-21512", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "50672", "trust": 0.1 } ], "sources": [ { "db": "CERT/CC", "id": "VU#400601" }, { "db": "VULHUB", "id": "VHN-21512" }, { "db": "BID", "id": "20348" }, { "db": "JVNDB", "id": "JVNDB-2006-003319" }, { "db": "PACKETSTORM", "id": "50672" }, { "db": "NVD", "id": "CVE-2006-5404" }, { "db": "CNNVD", "id": "CNNVD-200610-316" } ] }, "id": "VAR-200610-0183", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-21512" } ], "trust": 0.01 }, "last_update_date": "2023-12-18T13:15:55.654000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "SYM06-019", "trust": 0.8, "url": "http://securityresponse.symantec.com/avcenter/security/content/2006.10.05.html" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2006-003319" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "NVD-CWE-Other", "trust": 1.0 } ], "sources": [ { "db": "NVD", "id": "CVE-2006-5404" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.1, "url": "http://securityresponse.symantec.com/avcenter/security/content/2006.10.05.html" }, { "trust": 1.7, "url": "http://www.securityfocus.com/bid/20348" }, { "trust": 1.7, "url": "http://securitytracker.com/id?1016988" }, { "trust": 1.7, "url": "http://securitytracker.com/id?1016989" }, { "trust": 1.7, "url": "http://securitytracker.com/id?1016990" }, { "trust": 1.7, "url": "http://securitytracker.com/id?1016991" }, { "trust": 1.7, "url": "http://secunia.com/advisories/22228" }, { "trust": 1.1, "url": "http://www.vupen.com/english/advisories/2006/3929" }, { "trust": 1.1, "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29366" }, { "trust": 0.8, "url": "http://www.symantec.com/avcenter/security/content/2006.10.05.html" }, { "trust": 0.8, "url": "http://www.securityfocus.com/bid/20348 " }, { "trust": 0.8, "url": "http://securitytracker.com/id?1016988 " }, { "trust": 0.8, "url": "http://securitytracker.com/id?1016989 " }, { "trust": 0.8, "url": "http://securitytracker.com/id?1016990 " }, { "trust": 0.8, "url": "http://securitytracker.com/id?1016991 " }, { "trust": 0.8, "url": "http://secunia.com/advisories/22228 " }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-5404" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-5404" }, { "trust": 0.6, "url": "http://xforce.iss.net/xforce/xfdb/29366" }, { "trust": 0.6, "url": "http://www.frsirt.com/english/advisories/2006/3929" }, { "trust": 0.3, "url": "http://www.symantec.com" }, { "trust": 0.3, "url": "http://www.kb.cert.org/vuls/id/400601" }, { "trust": 0.1, "url": "http://secunia.com/product/4009/" }, { "trust": 0.1, "url": "http://secunia.com/product/6635/" }, { "trust": 0.1, "url": "http://secunia.com/secunia_security_advisories/" }, { "trust": 0.1, "url": "http://secunia.com/product/4848/" }, { "trust": 0.1, "url": "http://secunia.com/product/12212/" }, { "trust": 0.1, "url": "http://secunia.com/product/6636/" }, { "trust": 0.1, "url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/" }, { "trust": 0.1, "url": "http://secunia.com/advisories/22228/" }, { "trust": 0.1, "url": "https://www-secure.symantec.com/techsupp/asa/install.jsp" }, { "trust": 0.1, "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org" }, { "trust": 0.1, "url": "http://secunia.com/product/4847/" }, { "trust": 0.1, "url": "http://secunia.com/product/6634/" }, { "trust": 0.1, "url": "http://secunia.com/about_secunia_advisories/" } ], "sources": [ { "db": "CERT/CC", "id": "VU#400601" }, { "db": "VULHUB", "id": "VHN-21512" }, { "db": "BID", "id": "20348" }, { "db": "JVNDB", "id": "JVNDB-2006-003319" }, { "db": "PACKETSTORM", "id": "50672" }, { "db": "NVD", "id": "CVE-2006-5404" }, { "db": "CNNVD", "id": "CNNVD-200610-316" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CERT/CC", "id": "VU#400601" }, { "db": "VULHUB", "id": "VHN-21512" }, { "db": "BID", "id": "20348" }, { "db": "JVNDB", "id": "JVNDB-2006-003319" }, { "db": "PACKETSTORM", "id": "50672" }, { "db": "NVD", "id": "CVE-2006-5404" }, { "db": "CNNVD", "id": "CNNVD-200610-316" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2006-11-08T00:00:00", "db": "CERT/CC", "id": "VU#400601" }, { "date": "2006-10-19T00:00:00", "db": "VULHUB", "id": "VHN-21512" }, { "date": "2006-10-05T00:00:00", "db": "BID", "id": "20348" }, { "date": "2012-12-20T00:00:00", "db": "JVNDB", "id": "JVNDB-2006-003319" }, { "date": "2006-10-08T20:37:03", "db": "PACKETSTORM", "id": "50672" }, { "date": "2006-10-19T01:07:00", "db": "NVD", "id": "CVE-2006-5404" }, { "date": "2006-10-18T00:00:00", "db": "CNNVD", "id": "CNNVD-200610-316" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2006-11-08T00:00:00", "db": "CERT/CC", "id": "VU#400601" }, { "date": "2017-07-20T00:00:00", "db": "VULHUB", "id": "VHN-21512" }, { "date": "2006-11-13T19:07:00", "db": "BID", "id": "20348" }, { "date": "2012-12-20T00:00:00", "db": "JVNDB", "id": "JVNDB-2006-003319" }, { "date": "2017-07-20T01:33:43.307000", "db": "NVD", "id": "CVE-2006-5404" }, { "date": "2006-10-19T00:00:00", "db": "CNNVD", "id": "CNNVD-200610-316" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-200610-316" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Symantec Automated Support Assistant ActiveX control buffer overflow", "sources": [ { "db": "CERT/CC", "id": "VU#400601" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Boundary Condition Error", "sources": [ { "db": "BID", "id": "20348" }, { "db": "CNNVD", "id": "CNNVD-200610-316" } ], "trust": 0.9 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.