CVE-2009-1428: XSS
First published: Wed Apr 29 2009(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in ccLgView.exe in the Symantec Log Viewer, as used in Symantec AntiVirus (SAV) before 10.1 MR8, Symantec Endpoint Protection (SEP) 11.0 before 11.0 MR1, Norton 360 1.0, and Norton Internet Security 2005 through 2008, allow remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, related to "two parsing errors."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Symantec Norton Internet Security | =2006 | |
| Symantec Antivirus | =10.0.7 | |
| Symantec Antivirus | =10.0.2.1 | |
| Symantec Antivirus | <=10.1 | |
| Symantec Norton Internet Security | =2008 | |
| Symantec Norton Internet Security | =2005_contains_nav_11.0.0 | |
| Symantec Norton Internet Security | =2005-11.5.6.14 | |
| Symantec Antivirus | =10.0.6 | |
| Symantec Norton Internet Security | =2007 | |
| Symantec Antivirus | =10.0.3 | |
| Symantec Antivirus | =10.0.4 | |
| Symantec Norton Internet Security | =2005 | |
| Symantec Antivirus | =10.0.2.2 | |
| Symantec Norton Internet Security | =2005-11.0.9 | |
| Symantec Norton Internet Security | =2005 | |
| Symantec Antivirus | =10.0.2 | |
| Symantec Endpoint Protection | =11.0 | |
| Symantec Antivirus | =10.0.1 | |
| Symantec Norton Internet Security | =2005-11.0 | |
| Symantec Antivirus | =10.0.8 | |
| Symantec Norton Internet Security | =2006 | |
| Symantec Antivirus | =10.0.1.1 | |
| Symantec Antivirus | =10.0.5 | |
| Symantec Antivirus | =10.0.9 | |
| Symantec Antivirus | =10.0 | |
| Symantec Norton 360 | =1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://osvdb.org/54132
- http://secunia.com/advisories/34936
- http://www.securityfocus.com/bid/34669
- http://www.securitytracker.com/id?1022133
- http://www.securitytracker.com/id?1022134
- http://www.securitytracker.com/id?1022135
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_01
- http://www.vupen.com/english/advisories/2009/1203
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50170
Frequently Asked Questions
What is the severity of CVE-2009-1428?
CVE-2009-1428 is considered to be a moderate severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2009-1428?
To fix CVE-2009-1428, users should update their Symantec products to versions that are patched against this vulnerability.
What does CVE-2009-1428 exploit?
CVE-2009-1428 exploits multiple cross-site scripting (XSS) vulnerabilities in ccLgView.exe used in various Symantec products.
Which software is affected by CVE-2009-1428?
CVE-2009-1428 affects multiple versions of Symantec AntiVirus, Symantec Endpoint Protection, Norton 360, and Norton Internet Security.
Can CVE-2009-1428 allow remote code execution?
CVE-2009-1428 does not directly allow remote code execution, but it can be leveraged to manipulate user sessions through XSS.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/symantec
- canonical/symantec norton internet security
- version/symantec norton internet security/2006
- canonical/symantec antivirus
- version/symantec antivirus/10.0.7
- version/symantec antivirus/10.0.2.1
- version/symantec antivirus/10.1
- version/symantec norton internet security/2008
- version/symantec norton internet security/2005_contains_nav_11.0.0
- version/symantec norton internet security/2005-11.5.6.14
- version/symantec antivirus/10.0.6
- version/symantec norton internet security/2007
- version/symantec antivirus/10.0.3
- version/symantec antivirus/10.0.4
- version/symantec norton internet security/2005
- version/symantec antivirus/10.0.2.2
- version/symantec norton internet security/2005-11.0.9
- version/symantec antivirus/10.0.2
- canonical/symantec endpoint protection
- version/symantec endpoint protection/11.0
- version/symantec antivirus/10.0.1
- version/symantec norton internet security/2005-11.0
- version/symantec antivirus/10.0.8
- version/symantec antivirus/10.0.1.1
- version/symantec antivirus/10.0.5
- version/symantec antivirus/10.0.9
- version/symantec antivirus/10.0
- canonical/symantec norton 360
- version/symantec norton 360/1.0