SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   Norton Internet Security Vendors:   Symantec
Norton Internet Security Input Validation Flaw in Log Viewer Permits Remote HTML Injection Attacks
SecurityTracker Alert ID:  1022133
SecurityTracker URL:  http://securitytracker.com/id/1022133
CVE Reference:   CVE-2009-1428   (Links to External Site)
Date:  Apr 28 2009
Impact:   Disclosure of user information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2005 through 2008
Description:   A vulnerability was reported in Norton Internet Security. A remote user can conduct HTML injection attacks.

The Log Viewer (ccLgView.exe) does not properly filter HTML code from user-supplied input before displaying the input. A remote user can send an e-mail containing specially crafted arbitrary JavaScript code. When the target user views the event log via the 'View Logs - Email Filtering' option from the Statistics option of the Symantec Log Viewer, the arbitrary scripting code will be executed on the target user's system. The code may be able to access data on the viewer or take actions on the viewer acting as the target user.

Mark Litchfield from Next Generation Security Software reported this vulnerability.

Impact:   A remote user may be able to access data on the viewer take actions on the viewer acting as the target user.
Solution:   The vendor has issue a fix (2009), available via LiveUpdate.

The vendor's advisory is available at:

http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_01

Vendor URL:  www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_01 (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC