Signature Detail

HTTP: Symantec Norton Antivirus NavComUI.dll Exploit

This signature detects attempts to exploit a known vulnerability in Symantec Norton Antivirus. An attacker can create malicious Web pages containing dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Multiple Symantec Norton products are prone to a remote code-execution vulnerability. This issue occurs in ActiveX controls that are shared across multiple products. Invoking the object from a malicious website or HTML email may trigger this condition. Successful exploits allow remote attackers to execute code and to compromise affected computers. Failed exploit attempts likely result in computer crashes. The following products are vulnerable to this issue: Norton Antivirus 2006 Norton Internet Security 2006 Norton Internet Security, Anti Spyware Edition 2005 Norton System Works 2006

Affected Products

• Symantec norton_antivirus_2006
• Symantec norton_internet_security_2005_anti_spyware_edition
• Symantec norton_internet_security_2006
• Symantec norton_system_works_2006

References

• BugTraq: 24983
• CVE: CVE-2007-2955
• URL: http://www.symantec.com/avcenter/security/Content/2007.08.09.html