SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   Symantec Anti Virus Vendors:   Symantec
Symantec Anti Virus Input Validation Flaw in Log Viewer Permits Remote HTML Injection Attacks
SecurityTracker Alert ID:  1022134
SecurityTracker URL:  http://securitytracker.com/id/1022134
CVE Reference:   CVE-2009-1428   (Links to External Site)
Date:  Apr 28 2009
Impact:   Disclosure of user information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 10.1 MR7 and prior versions
Description:   A vulnerability was reported in Symantec Anti Virus. A remote user can conduct HTML injection attacks.

The Log Viewer (ccLgView.exe) does not properly filter HTML code from user-supplied input before displaying the input. A remote user can send an e-mail containing specially crafted arbitrary JavaScript code. When the target user views the event log via the 'View Logs - Email Filtering' option from the Statistics option of the Symantec Log Viewer, the arbitrary scripting code will be executed on the target user's system. The code may be able to access data on the viewer or take actions on the viewer acting as the target user.

Mark Litchfield from Next Generation Security Software reported this vulnerability.

Impact:   A remote user may be able to access data on the viewer take actions on the viewer acting as the target user.
Solution:   The vendor has issue a fix (10.1 MR 8).

The vendor's advisory is available at:

http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_01

Vendor URL:  www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_01 (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC