Description
Multiple format string vulnerabilities in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security 1.x up to 3.0, allow local users to execute arbitrary code via format strings in (1) Tamper Protection and (2) Virus Alert Notification messages.
References
- 1016842 vdb-entry
- symantecantivirus-messages-code-execution(28936) vdb-entry
- 20060914 Layered Defense Advisory :Symantec AntiVirus Corporate Edition Format String Vulnerability mailing-list
- http://layereddefense.com/SAV13SEPT.html
- 19986 vdb-entry
- 21884 third-party-advisory
- http://securityresponse.symantec.com/avcenter/security/Content/2006.09.13.html
- ADV-2006-3599 vdb-entry
- 20060918 Symantec Security Advisory: Symantec AntiVirus Corporate Edition mailing-list