CVE-2007-2955: Input Validation
First published: Thu Aug 09 2007(Updated: )
Multiple unspecified "input validation error" vulnerabilities in multiple ActiveX controls in NavComUI.dll, as used in multiple Norton AntiVirus, Internet Security, and System Works products for 2006, allows remote attackers to execute arbitrary code via (1) the AnomalyList property to AxSysListView32 and (2) Anomaly property to AxSysListView32OAA.
Credit: PSIRT-CNA@flexerasoftware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Symantec norton system works | =2006 | |
| Symantec Norton Internet Security | =2005 | |
| Symantec Norton Antivirus with Backup | =2006 | |
| Symantec Norton Internet Security | =2006 | |
| Symantec Norton System Works | =2006 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/secunia_research/2007-53/advisory/
- http://www.symantec.com/avcenter/security/Content/2007.08.09.html
- http://www.securityfocus.com/bid/24983
- http://www.securitytracker.com/id?1018545
- http://www.securitytracker.com/id?1018546
- http://www.securitytracker.com/id?1018547
- http://secunia.com/advisories/25215
- http://www.vupen.com/english/advisories/2007/2822
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35944
Frequently Asked Questions
What is the severity of CVE-2007-2955?
CVE-2007-2955 has been classified as a critical vulnerability due to its potential to allow remote code execution.
What types of software are affected by CVE-2007-2955?
CVE-2007-2955 affects multiple ActiveX controls in Norton AntiVirus, Internet Security, and System Works products from 2005 and 2006.
How can I fix CVE-2007-2955?
To remediate CVE-2007-2955, users should update their affected Symantec products to the latest versions provided by the vendor.
What potential risks does CVE-2007-2955 pose to users?
CVE-2007-2955 poses the risk of allowing remote attackers to execute arbitrary code on affected systems.
Is there a workaround for CVE-2007-2955?
A common workaround for CVE-2007-2955 is to disable or uninstall the vulnerable ActiveX controls until a patch can be applied.
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/symantec
- canonical/symantec norton system works
- version/symantec norton system works/2006
- canonical/symantec norton internet security
- version/symantec norton internet security/2005
- canonical/symantec norton antivirus with backup
- version/symantec norton antivirus with backup/2006
- version/symantec norton internet security/2006