VAR-200705-0188
Vulnerability from variot - Updated: 2023-12-18 13:05Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows remote attackers to execute arbitrary code via long arguments to the (1) Get and (2) Set functions. Symantec Norton Personal Firewall is a very popular firewall software. The Get() and Set() functions used by the ISAlertDataCOM function in the ISLALERT.DLL library of Norton Personal Firewall do not correctly verify the input parameters. If the user is tricked into browsing a specially crafted HTML document, it may trigger a buffer overflow, resulting in a login user permissions to execute arbitrary commands
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200705-0188",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "norton personal firewall",
"scope": "eq",
"trust": 2.7,
"vendor": "symantec",
"version": "2004"
},
{
"model": "norton internet security",
"scope": "eq",
"trust": 2.7,
"vendor": "symantec",
"version": "2004"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "symantec",
"version": null
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#983953"
},
{
"db": "BID",
"id": "23936"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-005314"
},
{
"db": "NVD",
"id": "CVE-2007-1689"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-345"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:symantec:norton_internet_security:2004:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:symantec:norton_personal_firewall:2004:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1689"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200705-345"
}
],
"trust": 0.6
},
"cve": "CVE-2007-1689",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2007-1689",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-25051",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-1689",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#983953",
"trust": 0.8,
"value": "3.61"
},
{
"author": "CNNVD",
"id": "CNNVD-200705-345",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-25051",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#983953"
},
{
"db": "VULHUB",
"id": "VHN-25051"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-005314"
},
{
"db": "NVD",
"id": "CVE-2007-1689"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-345"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows remote attackers to execute arbitrary code via long arguments to the (1) Get and (2) Set functions. Symantec Norton Personal Firewall is a very popular firewall software. The Get() and Set() functions used by the ISAlertDataCOM function in the ISLALERT.DLL library of Norton Personal Firewall do not correctly verify the input parameters. If the user is tricked into browsing a specially crafted HTML document, it may trigger a buffer overflow, resulting in a login user permissions to execute arbitrary commands",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1689"
},
{
"db": "CERT/CC",
"id": "VU#983953"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-005314"
},
{
"db": "BID",
"id": "23936"
},
{
"db": "VULHUB",
"id": "VHN-25051"
}
],
"trust": 2.7
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-25051",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-25051"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#983953",
"trust": 3.6
},
{
"db": "NVD",
"id": "CVE-2007-1689",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "25290",
"trust": 2.5
},
{
"db": "BID",
"id": "23936",
"trust": 2.0
},
{
"db": "OSVDB",
"id": "36164",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1018073",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2007-1843",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2007-005314",
"trust": 0.8
},
{
"db": "XF",
"id": "34328",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20070516 SYMANTEC PRODUCT SECURITY: NORTON PERSONAL FIREWALL 2004 ACTIVEX CONTROL VULNERABILITY",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200705-345",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-71124",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "16610",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "82926",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-25051",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#983953"
},
{
"db": "VULHUB",
"id": "VHN-25051"
},
{
"db": "BID",
"id": "23936"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-005314"
},
{
"db": "NVD",
"id": "CVE-2007-1689"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-345"
}
]
},
"id": "VAR-200705-0188",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-25051"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:05:03.389000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SYM07-007",
"trust": 0.8,
"url": "http://www.symantec.com/avcenter/security/content/2007.05.16.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-005314"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1689"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "http://www.symantec.com/avcenter/security/content/2007.05.16.html"
},
{
"trust": 2.8,
"url": "http://www.kb.cert.org/vuls/id/983953"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/23936"
},
{
"trust": 1.7,
"url": "http://osvdb.org/36164"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id?1018073"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/25290"
},
{
"trust": 1.1,
"url": "http://support.microsoft.com/kb/240797"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/468779/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2007/1843"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34328"
},
{
"trust": 0.8,
"url": "http://secunia.com/advisories/25290/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1689"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-1689"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/34328"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/468779/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2007/1843"
},
{
"trust": 0.3,
"url": "http://www.symantec.com/sabu/nis/nis_pe/"
},
{
"trust": 0.3,
"url": "http://www.symantec.com/sabu/nis/npf/"
},
{
"trust": 0.3,
"url": "msg://bugtraq/20070516210551.15698.qmail@securityfocus.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#983953"
},
{
"db": "VULHUB",
"id": "VHN-25051"
},
{
"db": "BID",
"id": "23936"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-005314"
},
{
"db": "NVD",
"id": "CVE-2007-1689"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-345"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#983953"
},
{
"db": "VULHUB",
"id": "VHN-25051"
},
{
"db": "BID",
"id": "23936"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-005314"
},
{
"db": "NVD",
"id": "CVE-2007-1689"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-345"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-05-16T00:00:00",
"db": "CERT/CC",
"id": "VU#983953"
},
{
"date": "2007-05-16T00:00:00",
"db": "VULHUB",
"id": "VHN-25051"
},
{
"date": "2007-05-16T00:00:00",
"db": "BID",
"id": "23936"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-005314"
},
{
"date": "2007-05-16T20:30:00",
"db": "NVD",
"id": "CVE-2007-1689"
},
{
"date": "2007-05-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200705-345"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-05-17T00:00:00",
"db": "CERT/CC",
"id": "VU#983953"
},
{
"date": "2018-10-16T00:00:00",
"db": "VULHUB",
"id": "VHN-25051"
},
{
"date": "2007-11-02T23:56:00",
"db": "BID",
"id": "23936"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-005314"
},
{
"date": "2018-10-16T16:40:32.677000",
"db": "NVD",
"id": "CVE-2007-1689"
},
{
"date": "2007-05-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200705-345"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200705-345"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Symantec Norton Internet Security 2004 ISAlertDataCOM ActiveX control stack buffer overflow",
"sources": [
{
"db": "CERT/CC",
"id": "VU#983953"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200705-345"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…