« Volver al listado

CVE-2016-5311

Estado: ModificadaAlta (7.8)—

A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security, Norton 360, Endpoint Protection Small Business Edition Cloud, and Endpoint Protection Cloud Client due to a DLL-preloading without path restrictions, which could let a local malicious user obtain system privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (9)

Symantec — Endpoint ProtectionSymantec — Endpoint Protection CloudSymantec — Norton 360Symantec — Norton AntivirusSymantec — Norton Antivirus With BackupSymantec — Norton FamilySymantec — Norton Internet SecuritySymantec — Norton SecuritySymantec — Norton Security With Backup

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-5311",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@symantec.com",
      "affectedData": [
        {
          "vendor": "Symantec",
          "product": "Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security, Norton 360",
          "versions": [
            {
              "status": "affected",
              "version": "before 22.7"
            }
          ]
        },
        {
          "vendor": "Symantec",
          "product": "Endpoint Protection Small Business Edition Cloud, and Endpoint Protection Cloud Client",
          "versions": [
            {
              "status": "affected",
              "version": "before 22.8.0.50"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-09T20:15:11.163",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/94295",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1037323",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1037324",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1037325",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20161117_00",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94295",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1037323",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1037324",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1037325",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20161117_00",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security, Norton 360, Endpoint Protection Small Business Edition Cloud, and Endpoint Protection Cloud Client due to a DLL-preloading without path restrictions, which could let a local malicious user obtain system privileges."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de escalada de privilegios en Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security, Norton 360, Endpoint Protection Small Business Edition Cloud y Endpoint Protection Cloud Client, debido a una precarga de DLL sin restricciones de ruta, que podría permitir a un usuario malicioso local obtener privilegios system."
    }
  ],
  "lastModified": "2026-06-17T00:49:11.633",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_protection:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99BAFC5B-CF3B-4B6E-A9FF-4426FB4F1C36",
              "versionEndExcluding": "22.8.0.50"
            },
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_protection_cloud:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DB3235B-B116-477F-A615-CA4D725A4102",
              "versionEndExcluding": "22.8.0.50"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_360:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB28D86F-DCDE-4034-B166-B3932FB6830D",
              "versionEndExcluding": "22.7"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_antivirus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2725D6BB-F411-4A0F-A68F-A40AE3D76F51",
              "versionEndExcluding": "22.7"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_antivirus_with_backup:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70D5D6E1-4E7C-44B9-8CC8-1B0EB5ADD462",
              "versionEndExcluding": "22.7"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_family:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFB88FB9-8802-4902-B430-4D4F77ECFB0A",
              "versionEndExcluding": "22.7"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_internet_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03C6560F-041D-4BDB-A857-359F22C93C60",
              "versionEndExcluding": "22.7"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93566F86-6E3B-4C8F-8CA5-6C1662AEEDED",
              "versionEndExcluding": "22.7"
            },
            {
              "criteria": "cpe:2.3:a:symantec:norton_security_with_backup:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53AAF3FD-F59A-4F2D-80E7-2D415C28431C",
              "versionEndExcluding": "22.7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@symantec.com"
}