CVE - CVE-2006-3456

CVE-ID
CVE-2006-3456	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via unspecified vectors related to content on a web site, and place Internet Explorer into a "defunct state" in which remote attackers can execute arbitrary code in addition to other Symantec ActiveX controls, regardless of whether they are marked safe for scripting. NOTE: this CVE was inadvertently used for an E-mail Auto-Protect issue, but that issue has been assigned CVE-2007-3771.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:23822 URL:http://www.securityfocus.com/bid/23822 CONFIRM:http://www.symantec.com/avcenter/security/Content/2007.05.09.html IDEFENSE:20070509 Symantec Norton Internet Security 2006 COM Object Security ByPass Vulnerability URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529 OSVDB:35075 URL:http://osvdb.org/35075 SECTRACK:1018031 URL:http://www.securitytracker.com/id?1018031 SECUNIA:25172 URL:http://secunia.com/advisories/25172 VUPEN:ADV-2007-1751 URL:http://www.vupen.com/english/advisories/2007/1751 XF:symantec-navopts-security-bypass(34200) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/34200
Assigning CNA
MITRE Corporation
Date Entry Created
20060707	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20060707)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select “Other” from dropdown)