9.3

CVE-2010-0111

HDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary programs by sending msgsys.exe a UNC share pathname, which is used directly in a CreateProcessA (aka CreateProcess) call.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Symantec ≫ Antivirus Version 10.0 Edition corporate
Symantec ≫ Antivirus Version 10.0 Update mr1 Edition corporate
Symantec ≫ Antivirus Version 10.0 Update mr2 Edition corporate
Symantec ≫ Antivirus Version 10.0.1 Edition corporate
Symantec ≫ Antivirus Version 10.0.1.1 Edition corporate
Symantec ≫ Antivirus Version 10.0.1.2 Edition corporate
Symantec ≫ Antivirus Version 10.0.2 Edition corporate
Symantec ≫ Antivirus Version 10.0.2.1 Edition corporate
Symantec ≫ Antivirus Version 10.0.2.2 Edition corporate
Symantec ≫ Antivirus Version 10.0.3 Edition corporate
Symantec ≫ Antivirus Version 10.0.4 Edition corporate
Symantec ≫ Antivirus Version 10.0.5 Edition corporate
Symantec ≫ Antivirus Version 10.0.6 Edition corporate
Symantec ≫ Antivirus Version 10.0.7 Edition corporate
Symantec ≫ Antivirus Version 10.0.8 Edition corporate
Symantec ≫ Antivirus Version 10.0.9 Edition corporate
Symantec ≫ Antivirus Version 10.1 Edition corporate
Symantec ≫ Antivirus Version 10.1 Update mp1 Edition corporate
Symantec ≫ Antivirus Version 10.1 Update mr4 Edition corporate
Symantec ≫ Antivirus Version 10.1 Update mr5 Edition corporate
Symantec ≫ Antivirus Version 10.1 Update mr6 Edition corporate
Symantec ≫ Antivirus Version 10.1 Update mr7 Edition corporate
Symantec ≫ Antivirus Version 10.1.0.1 Edition corporate
Symantec ≫ Antivirus Version 10.1.4 Edition corporate
Symantec ≫ Antivirus Version 10.1.4.1 Edition corporate
Symantec ≫ Antivirus Version 10.1.5 Edition corporate
Symantec ≫ Antivirus Version 10.1.5.1 Edition corporate
Symantec ≫ Antivirus Version 10.1.6 Edition corporate
Symantec ≫ Antivirus Version 10.1.6.1 Edition corporate
Symantec ≫ Antivirus Version 10.1.7 Edition corporate
Symantec ≫ Antivirus Version 10.1.8 Edition corporate
Symantec ≫ Antivirus Version 10.1.9 Edition corporate
Symantec ≫ Antivirus Version 10.2 Edition corporate
Symantec ≫ Antivirus Version 10.2 Update mr2 Edition corporate
Symantec ≫ Antivirus Version 10.2 Update mr3 Edition corporate
Symantec ≫ System Center Version 10.0
Symantec ≫ System Center Version 10.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 34.52% 0.982
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/43099
Vendor Advisory
http://www.vupen.com/english/advisories/2011/0234
Vendor Advisory
http://secunia.com/advisories/43106
Vendor Advisory
http://securitytracker.com/id?1024997
http://www.securityfocus.com/bid/45935
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_01
http://www.zerodayinitiative.com/advisories/ZDI-11-029
https://exchange.xforce.ibmcloud.com/vulnerabilities/64942
https://exchange.xforce.ibmcloud.com/vulnerabilities/64943