CVE-2006-3456

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-05-07T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to \"crash the control\" via unspecified vectors related to content on a web site, and place Internet Explorer into a \"defunct state\" in which remote attackers can execute arbitrary code in addition to other Symantec ActiveX controls, regardless of whether they are marked safe for scripting. NOTE: this CVE was inadvertently used for an E-mail Auto-Protect issue, but that issue has been assigned CVE-2007-3771."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-19T15:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.symantec.com/avcenter/security/Content/2007.05.09.html"}, {"name": "ADV-2007-1751", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/1751"}, {"name": "23822", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/23822"}, {"name": "25172", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/25172"}, {"name": "20070509 Symantec Norton Internet Security 2006 COM Object Security ByPass Vulnerability", "tags": ["third-party-advisory", "x_refsource_IDEFENSE"], "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529"}, {"name": "35075", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35075"}, {"name": "1018031", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1018031"}, {"name": "symantec-navopts-security-bypass(34200)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34200"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-3456", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to \"crash the control\" via unspecified vectors related to content on a web site, and place Internet Explorer into a \"defunct state\" in which remote attackers can execute arbitrary code in addition to other Symantec ActiveX controls, regardless of whether they are marked safe for scripting. NOTE: this CVE was inadvertently used for an E-mail Auto-Protect issue, but that issue has been assigned CVE-2007-3771."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.symantec.com/avcenter/security/Content/2007.05.09.html", "refsource": "CONFIRM", "url": "http://www.symantec.com/avcenter/security/Content/2007.05.09.html"}, {"name": "ADV-2007-1751", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/1751"}, {"name": "23822", "refsource": "BID", "url": "http://www.securityfocus.com/bid/23822"}, {"name": "25172", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/25172"}, {"name": "20070509 Symantec Norton Internet Security 2006 COM Object Security ByPass Vulnerability", "refsource": "IDEFENSE", "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529"}, {"name": "35075", "refsource": "OSVDB", "url": "http://osvdb.org/35075"}, {"name": "1018031", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1018031"}, {"name": "symantec-navopts-security-bypass(34200)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34200"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T18:30:33.495Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.symantec.com/avcenter/security/Content/2007.05.09.html"}, {"name": "ADV-2007-1751", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/1751"}, {"name": "23822", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/23822"}, {"name": "25172", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/25172"}, {"name": "20070509 Symantec Norton Internet Security 2006 COM Object Security ByPass Vulnerability", "tags": ["third-party-advisory", "x_refsource_IDEFENSE", "x_transferred"], "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529"}, {"name": "35075", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35075"}, {"name": "1018031", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1018031"}, {"name": "symantec-navopts-security-bypass(34200)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34200"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-3456", "datePublished": "2007-05-11T10:00:00.000Z", "dateReserved": "2006-07-07T00:00:00.000Z", "dateUpdated": "2024-08-07T18:30:33.495Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:symantec:norton_antivirus:2005:*:*:*:*:*:*:*", "matchCriteriaId": "11477B6E-C4C5-4664-91A7-D253077981F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:norton_antivirus:2006:*:*:*:*:*:*:*", "matchCriteriaId": "44843812-35FC-4378-B239-EEC74A0C8A39", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:norton_internet_security:2005:*:*:*:*:*:*:*", "matchCriteriaId": "06C7CD61-A47B-4521-8C6F-4BB1F4C95614", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:norton_internet_security:2006:*:*:*:*:*:*:*", "matchCriteriaId": "C1CC64B1-772C-42A9-9B0A-08CA92DC87E4", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:norton_system_works:2005:*:*:*:*:*:*:*", "matchCriteriaId": "29F670F0-FD5D-447C-94B8-691482D907F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:norton_system_works:2006:*:*:*:*:*:*:*", "matchCriteriaId": "05EB078C-2538-4961-ABFF-6C4601C3977F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to \"crash the control\" via unspecified vectors related to content on a web site, and place Internet Explorer into a \"defunct state\" in which remote attackers can execute arbitrary code in addition to other Symantec ActiveX controls, regardless of whether they are marked safe for scripting. NOTE: this CVE was inadvertently used for an E-mail Auto-Protect issue, but that issue has been assigned CVE-2007-3771."}, {"lang": "es", "value": "El control ActiveX Symantec NAVOPTS.DLL (tambi\u00e9n se conoce como Symantec.Norton.AntiVirus.NAVOptions) versi\u00f3n 12.2.0.13, tal y como es usado en Norton AntiVirus, Internet Security y System Works 2005 y 2006, est\u00e1 dise\u00f1ado para usarse \u00fanicamente en navegadores web integrados en aplicaciones, lo que permite atacantes remotos \"crash the control\" por medio de vectores no especificados relacionados con el contenido en un sitio web, y colocar Internet Explorer en un \"defunct state\" en el que los atacantes remotos pueden ejecutar c\u00f3digo arbitrario adem\u00e1s de otros controles ActiveX de Symantec, independientemente de si est\u00e1n marcados como seguros para el scripting. NOTA: este CVE fue utilizado inadvertidamente para un problema de protecci\u00f3n autom\u00e1tica de correo electr\u00f3nico, pero a ese problema ha sido asignado CVE-2007-3771."}], "id": "CVE-2006-3456", "lastModified": "2026-06-16T22:27:05.680", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 8.5, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-05-11T10:19:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35075"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/25172"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/23822"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1018031"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.symantec.com/avcenter/security/Content/2007.05.09.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2007/1751"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34200"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35075"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/25172"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/23822"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1018031"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.symantec.com/avcenter/security/Content/2007.05.09.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2007/1751"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34200"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}