Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-3644: Symantec products let attackers run code via crafted email

CVE-2016-3644 · published 10 years ago

Summary

Several Symantec security products can be tricked by specially formed email attachments, leading to unauthorized code execution or a crash. This means an attacker could take control of the affected system or make it stop working. Update to the latest patches from Symantec or replace the vulnerable products as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
symantec	norton_security	<= 13.0.1 `cpe:2.3:a:symantec:norton_security::::::macos::*`
symantec	protection_engine	>= 7.0.0, <= 7.0.5 >= 7.5.0, <= 7.5.4 7.8.0 `cpe:2.3:a:symantec:protection_engine::::::::`
symantec	advanced_threat_protection	<= 2.0.3 `cpe:2.3:a:symantec:advanced_threat_protection::::::::`
symantec	norton_bootable_removal_tool	<= 2016.0 `cpe:2.3:a:symantec:norton_bootable_removal_tool::::::::`
symantec	data_center_security_server	6.0 6.5 6.6 `cpe:2.3:a:symantec:data_center_security_server:6.0:::::::*`
symantec	protection_for_sharepoint_servers	>= 6.0, <= 6.0.6 >= 6.03, <= 6.05 `cpe:2.3:a:symantec:protection_for_sharepoint_servers::::::::`
symantec	message_gateway_for_service_providers	10.5 10.6 `cpe:2.3:a:symantec:message_gateway_for_service_providers:10.5:::::::*`
symantec	csapi	<= 10.0.4 `cpe:2.3:a:symantec:csapi::::::::`
symantec	endpoint_protection	12.1.6 `cpe:2.3:a:symantec:endpoint_protection:12.1.6:::::::*`
symantec	norton_power_eraser	<= 5.0 `cpe:2.3:a:symantec:norton_power_eraser::::::::`
symantec	mail_security_for_domino	>= 8.0, <= 8.0.9 >= 8.1, <= 8.1.3 `cpe:2.3:a:symantec:mail_security_for_domino::::::::`
symantec	mail_security_for_microsoft_exchange	>= 7.0, <= 7.0.4 >= 7.5, <= 7.5.4 6.5.8 `cpe:2.3:a:symantec:mail_security_for_microsoft_exchange::::::::`
symantec	message_gateway	<= 10.6.1-3 `cpe:2.3:a:symantec:message_gateway::::::::`
symantec	norton_360	All versions `cpe:2.3:a:symantec:norton_360::::::::`
symantec	norton_antivirus	All versions `cpe:2.3:a:symantec:norton_antivirus::::::::`
symantec	norton_internet_security	All versions `cpe:2.3:a:symantec:norton_internet_security::::::::`
symantec	norton_security_with_backup	All versions `cpe:2.3:a:symantec:norton_security_with_backup::::::::`
symantec	ngc	<= 22.6 `cpe:2.3:a:symantec:ngc::::::::`

Original advisory text

The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via modified MIME data in a message.

References

http://www.securityfocus.com/bid/91431 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036198 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036199 Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/40034/ Third Party Advisory VDB Entry
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securi... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.4 High

Exploitation

18% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published30 Jun 2016

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2016-3644 · NVD

Track software like this

Free during beta