CVE-2017-13676 Code injection in Norton Remove & Reinstall
An attacker can execute arbitrary code by placing a malicious DLL in the application's search path, affecting Norton Remove & Reinstall users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-13676?
CVE-2017-13676 is a high-severity code injection vulnerability in Symantec Corporation Norton Remove & Reinstall, published on 27 Sep 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Norton Remove & Reinstall can be susceptible to a DLL preloading vulnerability. These types of issues occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a specific search path to locate the DLL. The vulnerability can be exploited by a simple file write (or potentially an over-write) which results in a foreign DLL running under the context of the application. A Norton Remove & Reinstall update, version 4.4.0.58, has been released which addresses the aforementioned vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2017-13676?
It affects 1 product.
Products include Norton Remove \& Reinstall.
How do I fix CVE-2017-13676?
No fix has been published for CVE-2017-13676 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-13676 being exploited?
There is no known exploitation of CVE-2017-13676 in the wild and no public exploit code.
Sources
Also known as GHSA-w85q-f77r-393q.