Signature Detail

HTTP: Symantec Norton Antivirus NavComUI.dll Exploit

This signature detects attempts to exploit a known vulnerability in Symantec Norton Antivirus. An attacker can create malicious Web pages containing dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Multiple Symantec Norton products are prone to a remote code-execution vulnerability. This issue occurs in ActiveX controls that are shared across multiple products. Invoking the object from a malicious website or HTML email may trigger this condition. Successful exploits allow remote attackers to execute code and to compromise affected computers. Failed exploit attempts likely result in computer crashes. The following products are vulnerable to this issue: Norton Antivirus 2006 Norton Internet Security 2006 Norton Internet Security, Anti Spyware Edition 2005 Norton System Works 2006

Affected Products

• Symantec Norton AntiVirus 2006
• Symantec Norton Internet Security 2005 Anti Spyware Edition
• Symantec Norton Internet Security 2006
• Symantec Norton System Works 2006

References

• BugTraq: 24983
• CVE: CVE-2007-2955
• URL: http://www.symantec.com/avcenter/security/Content/2007.08.09.html