CVE-2007-1793 Memory corruption in n/a
Local attackers can cause a crash or execute arbitrary code by passing crafted arguments to specific system calls in Symantec Norton Personal Firewall.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-1793?
CVE-2007-1793 is a medium-severity memory corruption vulnerability in Symantec Norton Antivirus, published on 2 Apr 2007. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service (crash) or possibly execute arbitrary code via crafted arguments to the (1) NtCreateMutant and (2) NtOpenEvent functions. NOTE: it was later reported that Norton Internet Security 2008 15.0.0.60, and possibly other versions back to 2006, are also affected.
Weakness: CWE-20
Which versions are affected by CVE-2007-1793?
It affects 8 products.
Products include Symantec Antivirus, Symantec Client Security, Symantec Norton 360, Symantec Norton Antispam, Symantec Norton Antivirus, Symantec Norton Internet Security and 2 more.
How do I fix CVE-2007-1793?
No fix has been published for CVE-2007-1793 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2007-1793 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-1793 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Symantec Norton Antivirus
Sources
Also known as GHSA-6jrx-j7r6-m2m9.