HTTP: Symantec Norton Antivirus NavComUI.dll Exploit

This signature detects attempts to exploit a known vulnerability in Symantec Norton Antivirus. An attacker can create malicious Web pages containing dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Multiple Symantec Norton products are prone to a remote code-execution vulnerability. This issue occurs in ActiveX controls that are shared across multiple products. Invoking the object from a malicious website or HTML email may trigger this condition. Successful exploits allow remote attackers to execute code and to compromise affected computers. Failed exploit attempts likely result in computer crashes. The following products are vulnerable to this issue: Norton Antivirus 2006 Norton Internet Security 2006 Norton Internet Security, Anti Spyware Edition 2005 Norton System Works 2006

Affected Products

Symantec norton_system_works_2006

References

BugTraq: 24983

CVE: CVE-2007-2955

URL: http://www.symantec.com/avcenter/security/Content/2007.08.09.html

Short Name

HTTP:STC:ACTIVEX:SYMC-NAVCOMUI

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Symantec Norton Antivirus NavComUI.dll Exploit

Extended Description

Affected Products

References

Found a potential security threat?