CVE-2006-4266: Low severity Symantec Norton Personal Firewall vulnerability
Symantec Norton Personal Firewall 2006 9.1.0.33, and possibly earlier, does not properly protect Norton registry keys, which allows local users to provide Trojan horse libraries to Norton by using RegSaveKey and RegRestoreKey to modify HKLM\SOFTWARE\Symantec\CCPD\SuiteOwners, as demonstrated using NISProd.dll. NOTE: in most cases, this attack would not cross privilege boundaries, because modifying the SuiteOwners key requires administrative privileges. However, this issue is a vulnerability because the product's functionality is intended to protect against privileged actions such as this.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-4266?
CVE-2006-4266 has a medium severity rating due to the potential for local users to modify critical registry keys.
How do I mitigate CVE-2006-4266?
To mitigate CVE-2006-4266, ensure that appropriate permissions are set on the registry keys or consider disabling the vulnerable version of Norton Personal Firewall.
Which versions are affected by CVE-2006-4266?
CVE-2006-4266 affects Symantec Norton Personal Firewall versions up to and including 2006 9.1.0.33.
Can CVE-2006-4266 be exploited remotely?
No, CVE-2006-4266 requires local access to exploit the vulnerability.
What type of attack is facilitated by CVE-2006-4266?
CVE-2006-4266 facilitates DLL injection attacks through improper protection of Norton registry keys.