VulnerabilityModified
CVE-2005-2758
Integer signedness error in the administrative interface for Symantec AntiVirus Scan Engine 4.0 and 4.3 allows remote attackers to execute arbitrary code via crafted HTTP headers with negative values, which lead to a heap-based buffer overflow.
HIGH 10.0EPSS 13.4%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 13.4%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Integer signedness error in the administrative interface for Symantec AntiVirus Scan Engine 4.0 and 4.3 allows remote attackers to execute arbitrary code via crafted HTTP headers with negative values, which lead to a heap-based buffer overflow.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 13.44% probability · 96th percentile
- CISA KEV
- Not listed
- Affected
- symantec/antivirus scan engine · symantec/antivirus scan engine for network attached storage
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/17049
- http://securityreason.com/securityalert/48
- http://securitytracker.com/id?1015001
- http://www.idefense.com/application/poi/display?id=314&type=vulnerabilitiesPatch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/849209US Government Resource
- http://www.osvdb.org/19854
- http://www.securityfocus.com/bid/15001
- http://www.symantec.com/avcenter/security/Content/2005.10.04.htmlPatch, Vendor Advisory
- http://www.vupen.com/english/advisories/2005/1954
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22519
- http://secunia.com/advisories/17049
- http://securityreason.com/securityalert/48
- http://securitytracker.com/id?1015001
- http://www.idefense.com/application/poi/display?id=314&type=vulnerabilitiesPatch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/849209US Government Resource
- http://www.osvdb.org/19854
- http://www.securityfocus.com/bid/15001
- http://www.symantec.com/avcenter/security/Content/2005.10.04.htmlPatch, Vendor Advisory
- http://www.vupen.com/english/advisories/2005/1954
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22519
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.