« Volver al listado

CVE-2006-3456

Estado: ModificadaAlta (8.5)—

The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via unspecified vectors related to content on a web site, and place Internet Explorer into a "defunct state" in which remote attackers can execute arbitrary code in addition to other Symantec ActiveX controls, regardless of whether they are marked safe for scripting. NOTE: this CVE was inadvertently used for an E-mail Auto-Protect issue, but that issue has been assigned CVE-2007-3771.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Symantec — Norton AntivirusSymantec — Norton Internet SecuritySymantec — Norton System Works

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-3456",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-05-11T10:19:00.000",
  "references": [
    {
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/35075",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/25172",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/23822",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1018031",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.symantec.com/avcenter/security/Content/2007.05.09.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/1751",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34200",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/35075",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/25172",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/23822",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1018031",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.symantec.com/avcenter/security/Content/2007.05.09.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/1751",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34200",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to \"crash the control\" via unspecified vectors related to content on a web site, and place Internet Explorer into a \"defunct state\" in which remote attackers can execute arbitrary code in addition to other Symantec ActiveX controls, regardless of whether they are marked safe for scripting.  NOTE: this CVE was inadvertently used for an E-mail Auto-Protect issue, but that issue has been assigned CVE-2007-3771."
    },
    {
      "lang": "es",
      "value": "El control ActiveX Symantec NAVOPTS.DLL (también se conoce como Symantec.Norton.AntiVirus.NAVOptions) versión 12.2.0.13, tal y como es usado en Norton AntiVirus, Internet Security y System Works 2005 y 2006, está diseñado para usarse únicamente en navegadores web integrados en aplicaciones, lo que permite atacantes remotos \"crash the control\" por medio de vectores no especificados relacionados con el contenido en un sitio web, y colocar Internet Explorer en un \"defunct state\" en el que los atacantes remotos pueden ejecutar código arbitrario además de otros controles ActiveX de Symantec, independientemente de si están marcados como seguros para el scripting. NOTA: este CVE fue utilizado inadvertidamente para un problema de protección automática de correo electrónico, pero a ese problema ha sido asignado CVE-2007-3771."
    }
  ],
  "lastModified": "2026-06-16T22:27:05.680",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:symantec:norton_antivirus:2005:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11477B6E-C4C5-4664-91A7-D253077981F6"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_antivirus:2006:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44843812-35FC-4378-B239-EEC74A0C8A39"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_internet_security:2005:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06C7CD61-A47B-4521-8C6F-4BB1F4C95614"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_internet_security:2006:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1CC64B1-772C-42A9-9B0A-08CA92DC87E4"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_system_works:2005:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29F670F0-FD5D-447C-94B8-691482D907F2"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_system_works:2006:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05EB078C-2538-4961-ABFF-6C4601C3977F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}