Improper input validation in Symantec Antivirus
CVE-2010-0111
HDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary programs by sending msgsys.exe a UNC share pathname, which is used directly in a CreateProcessA (aka CreateProcess) call.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.345 (98.4th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.345 · newest: 0.345 · change: 0.000
Affected products
- Symantec Antivirus — versions 10.0, 10.0.1, 10.0.1.1
- Symantec Antivirus Central Quarantine Server — versions 3.5, 3.6
- Symantec System Center — versions 10.0, 10.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secunia.com/advisories/43099 (Vendor Advisory, third-party-advisory)
- www.zerodayinitiative.com/advisories/ZDI-11-029
- exchange.xforce.ibmcloud.com/vulnerabilities/64943 (vdb-entry)
- secunia.com/advisories/43106 (Vendor Advisory, third-party-advisory)
- www.symantec.com/security_response/securityupdates/detail.jsp
- exchange.xforce.ibmcloud.com/vulnerabilities/64942 (vdb-entry)
- www.securityfocus.com/bid/45935 (vdb-entry)
- www.vupen.com/english/advisories/2011/0234 (vdb-entry, Vendor Advisory)
- securitytracker.com/id (vdb-entry)
Frequently asked questions
- What is CVE-2010-0111?
- CVE-2010-0111 is a vulnerability in Symantec Antivirus, classified under Improper Input Validation. Published 2011-01-31.
- Is CVE-2010-0111 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.