NetSight
IP …
medium4.9Public exploit code

CVE-2007-1793

SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function han…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service (crash) or possibly execute arbitrary code via crafted arguments to the (1) NtCreateMutant and (2) NtOpenEvent functions. NOTE: it was later reported that Norton Internet Security 2008 15.0.0.60, and possibly other versions back to 2006, are also affected.

Affected products

VendorProductAffected versions
SymantecAntivirus
Versions 10.0, 10.0.1, 10.0.1.1, 10.0.2, 10.0.2.1, 10.0.2.2
SymantecClient Security
Versions 3.0, 3.0.0.359, 3.0.1.1000, 3.0.1.1001, 3.0.1.1007, 3.0.1.1008
SymantecNorton 360
Version 1.0
SymantecNorton Antispam
Versions 2004, 2005
SymantecNorton Antivirus
Versions 2004, 2005, 2006, 2007, 2008
SymantecNorton Internet Security
Versions 2004, 2005, 2006, 2007, 2008
SymantecNorton Personal Firewall
Versions 2004, 2005, 2006, 2006_9.1.0.33, 2006_9.1.1.7
SymantecNorton System Works
Versions 2004, 2005, 2006

Weakness classification

CWE-20

References