Symantec AntiVirus Scan Engine Remote Buffer Overflow Vulnerability (CVE-2005-2758)

Key Information Summary Vulnerability Basic Information Name: Symantec AntiVirus Scan Engine Web Service Buffer Overflow Vulnerability Disclosure Date: 2005.10.05 Risk Level: High CVE: CVE-2005-2758 CVSS Base Score: 10/10 Exploit Scope: Remote Impact: - Impact Subscore: 10/10 - Attack Complexity: Low - Confidentiality Impact: Complete - Integrity Impact: Complete - Availability Impact: Complete Vulnerability Description Description: Remote exploitation of a buffer overflow vulnerability in Symantec AntiVirus Scan Engine allows remote attackers to execute arbitrary code. Cause: Due to insufficient input validation of HTTP headers, remote attackers can send specially crafted HTTP requests to the management port 8004, causing the service to crash or execute arbitrary code. Impact: Successful exploitation of this vulnerability can lead to remote code execution with SYSTEM privileges. Exploiting this vulnerability requires no credentials or additional attack elements—only sending an HTTP request to TCP port 8004 is needed. Detection and Mitigation Detection: iDEFENSE Labs has confirmed the existence of this vulnerability in Symantec AntiVirus Scan Engine 4.0. Mitigation Measures: - Customers are advised to apply the vendor-provided fix or upgrade to the latest version. - Default installation instructions recommend that customers access the management interface through a secure network segment and restrict port 8004 to internal access only. Vendor Response Symantec: Has acknowledged the issue and released a security update. Customers are advised to immediately apply the latest update to protect their products from such threats. Discoverer Discoverer: The discoverer wishes to remain anonymous; credit is given to infamous41md[at]hotpop.com for this discovery.

Goal Reached Thanks to every supporter — we hit 100%!

Symantec AntiVirus Scan Engine Remote Buffer Overflow Vulnerability (CVE-2005-2758)