Vulnerability Name: | CVE-2012-4953 (CCN-79782) | ||||||||
Assigned: | 2012-11-05 | ||||||||
Published: | 2012-11-05 | ||||||||
Updated: | 2013-03-12 | ||||||||
Summary: | The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVirus Corporate Edition (SAVCE) 10.x, and Symantec Scan Engine (SSE) before 5.2.8 does not properly perform bounds checks of the contents of CAB archives, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file. | ||||||||
CVSS v3 Severity: | 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
Vulnerability Type: | CWE-119 | ||||||||
Vulnerability Consequences: | Gain Access | ||||||||
References: | Source: MITRE Type: CNA CVE-2012-4953 Source: CCN Type: US-CERT VU#985625 Symantec Antivirus products fail to properly handle CAB files Source: CERT-VN Type: US Government Resource VU#985625 Source: BID Type: UNKNOWN 56399 Source: CCN Type: BID-56399 Multiple Symantec Products CAB Files Handling Memory Corruption Vulnerability Source: SECTRACK Type: UNKNOWN 1027726 Source: CCN Type: Symantec Web site Symantec Source: CONFIRM Type: UNKNOWN http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121107_00 Source: XF Type: UNKNOWN symantec-cab-files-code-exec(79782) | ||||||||
Vulnerable Configuration: | Configuration 1: Configuration CCN 1: Denotes that component is vulnerable | ||||||||
BACK |