VulnerabilityModified
CVE-2006-0231
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications.
MEDIUM 6.4EPSS 1.94%
Does this matter?
Lower severity and a low EPSS score (1.94%). Track it; it rarely justifies an emergency change on its own.
Description
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 1.94% probability · 79th percentile
- CISA KEV
- Not listed
- Affected
- symantec/antivirus scan engine
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0011.htmlPatch, Vendor Advisory
- http://secunia.com/advisories/19734
- http://securitytracker.com/id?1015974
- http://www.securityfocus.com/archive/1/431725/100/0/threaded
- http://www.securityfocus.com/archive/1/431734/100/0/threaded
- http://www.securityfocus.com/bid/17637
- http://www.symantec.com/avcenter/security/Content/2006.04.21.html
- http://www.vupen.com/english/advisories/2006/1464
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25973
- http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0011.htmlPatch, Vendor Advisory
- http://secunia.com/advisories/19734
- http://securitytracker.com/id?1015974
- http://www.securityfocus.com/archive/1/431725/100/0/threaded
- http://www.securityfocus.com/archive/1/431734/100/0/threaded
- http://www.securityfocus.com/bid/17637
- http://www.symantec.com/avcenter/security/Content/2006.04.21.html
- http://www.vupen.com/english/advisories/2006/1464
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25973
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.