CVE-2006-3456: Code Injection
The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via unspecified vectors related to content on a web site, and place Internet Explorer into a "defunct state" in which remote attackers can execute arbitrary code in addition to other Symantec ActiveX controls, regardless of whether they are marked safe for scripting. NOTE: this CVE was inadvertently used for an E-mail Auto-Protect issue, but that issue has been assigned CVE-2007-3771.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3456?
CVE-2006-3456 has been classified as a moderate severity vulnerability.
How do I fix CVE-2006-3456?
To fix CVE-2006-3456, update the affected Symantec products to the latest version released by Symantec.
What systems are affected by CVE-2006-3456?
CVE-2006-3456 affects Symantec Norton AntiVirus, Internet Security, and System Works versions 2005 and 2006.
What types of attacks exploit CVE-2006-3456?
CVE-2006-3456 can be exploited by remote attackers to crash the affected ActiveX control.
What versions of Symantec products are vulnerable to CVE-2006-3456?
The vulnerable versions for CVE-2006-3456 include Symantec Norton Antivirus and System Works 2005 and 2006.