CVE-2010-3497

Symantec Norton AntiVirus 2011 does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution. NOTE: the researcher indicates that a vendor response was received, stating that this issue "falls into the work of our Firewall and not our AV (per our methodology of layers of defense)."

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.n00bz.net/antivirus-cve
http://www.securityfocus.com/archive/1/514356

Configurations

Configuration 1 (hide)

cpe:2.3:a:symantec:norton_antivirus:2011:*:*:*:*:*:*:*

History

No history.

Information

Published : 2012-08-22 10:42

Updated : 2024-02-28 12:00

NVD link : CVE-2010-3497

Mitre link : CVE-2010-3497

CVE.ORG link : CVE-2010-3497

JSON object : View

Products Affected

symantec

norton_antivirus

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2010-3497", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-08-22T10:42:04.070", "references": [{"url": "http://www.n00bz.net/antivirus-cve", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/514356", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Symantec Norton AntiVirus 2011 does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution. NOTE: the researcher indicates that a vendor response was received, stating that this issue \"falls into the work of our Firewall and not our AV (per our methodology of layers of defense).\""}, {"lang": "es", "value": "Symantec Norton AntiVirus 2011 no interact\u00faa de forma adecuada con el procesado de URLs hcp:// debido a la ayuda y centro de soporte de Microsoft, lo que hace que sea m\u00e1s f\u00e1cil para los atacantes remotos ejecutar c\u00f3digo a trav\u00e9s de malware que se detecta correctamente por este producto, pero con una detecci\u00f3n que ocurre demasiado tarde para detener la ejecuci\u00f3n de c\u00f3digo. NOTA: el investigador indica que el desarrollador le ha respondido \"Cae en la parte del firewall no de nuestro AV (por nuestra metodolog\u00eda de capas de defensa)\""}], "lastModified": "2012-08-22T10:42:04.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symantec:norton_antivirus:2011:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FE5C413-5627-4ECB-B510-CB0441487F8A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}