vulnwire
1.9low

CVE-2007-14761 exploit

The SymTDI device driver (SYMTDI.SYS) in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiV…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
1.9
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
1
Exploit-DB

The SymTDI device driver (SYMTDI.SYS) in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVirus Corporate Edition 3.0.x through 10.1.x, and other Norton products, allows local users to cause a denial of service (system crash) by sending crafted data to the driver's \Device file, which triggers invalid memory access, a different vulnerability than CVE-2006-4855.

Exploit prediction (EPSS)

0.89% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.

Exploits and detections

  • EDB-29743 Symantec 'SYMTDI.SYS' Device Driver - Local Denial of Service · dos · 2007-03-15

CVSS scores

Assigned byVersionScoreVector
NVD2.01.9AV:L/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • symantec.com /avcenter/security/Content/2007.09.05.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /archive/1/462926/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • marc.info /?l=full-disclosure&m=117396596027148&w=2 · mailing-list, x_refsource_FULLDISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/33003 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/22977 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /35088 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityreason.com /securityalert/2438 · third-party-advisory, x_refsource_SREASON, x_transferred
  • securitytracker.com /id?1018656 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • matousec.com /info/advisories/Norton-Insufficient-validation-of-SymTDI-driver-input-buffer.php · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.