Description
The SymTDI device driver (SYMTDI.SYS) in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVirus Corporate Edition 3.0.x through 10.1.x, and other Norton products, allows local users to cause a denial of service (system crash) by sending crafted data to the driver's \Device file, which triggers invalid memory access, a different vulnerability than CVE-2006-4855.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Symantec 'SYMTDI.SYS' Device Driver - Local Denial of Service EDB-29743 · dos · Mar 15, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.symantec.com/avcenter/security/Content/2007.09.05.html
- 20070315 Norton Insufficient validation of 'SymTDI' driver input buffer mailing-list
- 20070315 Norton Insufficient validation of 'SymTDI' driver mailing-list
- symantec-firewall-symtdi-dos(33003) vdb-entry
- 22977 vdb-entry
- 35088 vdb-entry
- 2438 third-party-advisory
- 1018656 vdb-entry
- http://www.matousec.com/info/advisories/Norton-Insufficient-validation-of-SymTDI-driver-input-buffer.php