Improper input validation in Symantec Client Security
CVE-2007-1476
The SymTDI device driver (SYMTDI.SYS) in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVirus Corporate Edition 3.0.x through 10.1.x, and other Norton products, allows local users to cause a denial of service (system crash) by sending crafted data to the driver's \Device file, which triggers invalid memory access, a different vulnerability than CVE-2006-4855.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.009 (54.9th percentile) — read the EPSS interpretation.
Affected products
- Symantec Client_security — versions 2.0, 2.0.1, 2.0.1_build_9.0.1.1000
- Symantec Norton_antispam — versions 2005
- Symantec Norton_antivirus — versions 3.0, 9.0, 9.0.0.338
- Symantec Norton_internet_security — versions 2005, 2006
- Symantec Norton_personal_firewall — versions 2005, 2006, 2006_9.1.0.33
- Symantec Norton_system_works — versions 2005, 2006
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (x_refsource_SREASON, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_MISC, Vendor Advisory)