var-200705-0188
Vulnerability from variot

Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows remote attackers to execute arbitrary code via long arguments to the (1) Get and (2) Set functions. Symantec Norton Personal Firewall is a very popular firewall software. The Get() and Set() functions used by the ISAlertDataCOM function in the ISLALERT.DLL library of Norton Personal Firewall do not correctly verify the input parameters. If the user is tricked into browsing a specially crafted HTML document, it may trigger a buffer overflow, resulting in a login user permissions to execute arbitrary commands

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200705-0188",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "norton personal firewall",
        "scope": "eq",
        "trust": 2.7,
        "vendor": "symantec",
        "version": "2004"
      },
      {
        "model": "norton internet security",
        "scope": "eq",
        "trust": 2.7,
        "vendor": "symantec",
        "version": "2004"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "symantec",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#983953"
      },
      {
        "db": "BID",
        "id": "23936"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-005314"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200705-345"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-1689"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:symantec:norton_internet_security",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:symantec:norton_personal_firewall",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-005314"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Will Dormann",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200705-345"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2007-1689",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2007-1689",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "VHN-25051",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2007-1689",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CARNEGIE MELLON",
            "id": "VU#983953",
            "trust": 0.8,
            "value": "3.61"
          },
          {
            "author": "NVD",
            "id": "CVE-2007-1689",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200705-345",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-25051",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#983953"
      },
      {
        "db": "VULHUB",
        "id": "VHN-25051"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-005314"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200705-345"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-1689"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows remote attackers to execute arbitrary code via long arguments to the (1) Get and (2) Set functions. Symantec Norton Personal Firewall is a very popular firewall software. The Get() and Set() functions used by the ISAlertDataCOM function in the ISLALERT.DLL library of Norton Personal Firewall do not correctly verify the input parameters. If the user is tricked into browsing a specially crafted HTML document, it may trigger a buffer overflow, resulting in a login user permissions to execute arbitrary commands",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2007-1689"
      },
      {
        "db": "CERT/CC",
        "id": "VU#983953"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-005314"
      },
      {
        "db": "BID",
        "id": "23936"
      },
      {
        "db": "VULHUB",
        "id": "VHN-25051"
      }
    ],
    "trust": 2.7
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-25051",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-25051"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#983953",
        "trust": 3.6
      },
      {
        "db": "NVD",
        "id": "CVE-2007-1689",
        "trust": 2.8
      },
      {
        "db": "SECUNIA",
        "id": "25290",
        "trust": 2.5
      },
      {
        "db": "BID",
        "id": "23936",
        "trust": 2.0
      },
      {
        "db": "OSVDB",
        "id": "36164",
        "trust": 1.7
      },
      {
        "db": "SECTRACK",
        "id": "1018073",
        "trust": 1.7
      },
      {
        "db": "VUPEN",
        "id": "ADV-2007-1843",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-005314",
        "trust": 0.8
      },
      {
        "db": "XF",
        "id": "34328",
        "trust": 0.6
      },
      {
        "db": "BUGTRAQ",
        "id": "20070516 SYMANTEC PRODUCT SECURITY: NORTON PERSONAL FIREWALL 2004 ACTIVEX CONTROL VULNERABILITY",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200705-345",
        "trust": 0.6
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-71124",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "16610",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "82926",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-25051",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#983953"
      },
      {
        "db": "VULHUB",
        "id": "VHN-25051"
      },
      {
        "db": "BID",
        "id": "23936"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-005314"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200705-345"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-1689"
      }
    ]
  },
  "id": "VAR-200705-0188",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-25051"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T21:57:12.373000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SYM07-007",
        "trust": 0.8,
        "url": "http://www.symantec.com/avcenter/security/Content/2007.05.16.html"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-005314"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2007-1689"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "http://www.symantec.com/avcenter/security/content/2007.05.16.html"
      },
      {
        "trust": 2.8,
        "url": "http://www.kb.cert.org/vuls/id/983953"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/23936"
      },
      {
        "trust": 1.7,
        "url": "http://osvdb.org/36164"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id?1018073"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/25290"
      },
      {
        "trust": 1.1,
        "url": "http://support.microsoft.com/kb/240797"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/archive/1/468779/100/0/threaded"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2007/1843"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34328"
      },
      {
        "trust": 0.8,
        "url": "http://secunia.com/advisories/25290/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1689"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-1689"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/34328"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/archive/1/archive/1/468779/100/0/threaded"
      },
      {
        "trust": 0.6,
        "url": "http://www.frsirt.com/english/advisories/2007/1843"
      },
      {
        "trust": 0.3,
        "url": "http://www.symantec.com/sabu/nis/nis_pe/"
      },
      {
        "trust": 0.3,
        "url": "http://www.symantec.com/sabu/nis/npf/"
      },
      {
        "trust": 0.3,
        "url": "msg://bugtraq/20070516210551.15698.qmail@securityfocus.com"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#983953"
      },
      {
        "db": "VULHUB",
        "id": "VHN-25051"
      },
      {
        "db": "BID",
        "id": "23936"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-005314"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200705-345"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-1689"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#983953"
      },
      {
        "db": "VULHUB",
        "id": "VHN-25051"
      },
      {
        "db": "BID",
        "id": "23936"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-005314"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200705-345"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-1689"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2007-05-16T00:00:00",
        "db": "CERT/CC",
        "id": "VU#983953"
      },
      {
        "date": "2007-05-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-25051"
      },
      {
        "date": "2007-05-16T00:00:00",
        "db": "BID",
        "id": "23936"
      },
      {
        "date": "2012-12-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2007-005314"
      },
      {
        "date": "2007-05-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200705-345"
      },
      {
        "date": "2007-05-16T20:30:00",
        "db": "NVD",
        "id": "CVE-2007-1689"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2007-05-17T00:00:00",
        "db": "CERT/CC",
        "id": "VU#983953"
      },
      {
        "date": "2018-10-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-25051"
      },
      {
        "date": "2007-11-02T23:56:00",
        "db": "BID",
        "id": "23936"
      },
      {
        "date": "2012-12-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2007-005314"
      },
      {
        "date": "2007-05-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200705-345"
      },
      {
        "date": "2024-11-21T00:28:55.913000",
        "db": "NVD",
        "id": "CVE-2007-1689"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200705-345"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Symantec Norton Internet Security 2004 ISAlertDataCOM ActiveX control stack buffer overflow",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#983953"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer overflow",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200705-345"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.