CVE:CVE-2006-3455
CNNVD:CNNVD-200610-380
Symantec AntiVirus是非常流行的杀毒解决方案。
Symantec AntiVirus的SAVRT.SYS驱动在处理输入缓冲区时存在漏洞，本地攻击者可能利用此漏洞提升权限或导致拒绝服务。
由于没有正确的验证输出缓冲区的地址空间，Symantec的SAVRT.SYS中的安全漏洞可能允许恶意用户使用DeviceIOControl()的输出缓冲区覆盖内核地址。成功利用这个漏洞可能允许本地攻击者以提升的权限执行任意指令或导致系统崩溃。
solution:Upgrade symantec client_security to a higher version than 1.1,1.1.1,1.1.1_build_393,1.1.1_mr1_build_8.1.1.314a,1.1.1_mr2_build_8.1.1.319,1.1.1_mr3_build_8.1.1.323,1.1.1_mr4_build_8.1.1.329,1.1.1_mr5_build_8.1.1.336,1.1.1_mr6_b8.1.1.266,1.1_stm_b8.1.0.825a,2.0,2.0.1,2.0.1_build_9.0.1.1000:mr1,2.0.2,2.0.2_build_9.0.2.1000:mr2,2.0.3,2.0.3_build_9.0.3.1000:mr3,2.0_scf_7.1,2.0_stm_build_9.0.0.338,and avoid the version 1.1,1.1.1,1.1.1_build_393,1.1.1_mr1_build_8.1.1.314a,1.1.1_mr2_build_8.1.1.319,1.1.1_mr3_build_8.1.1.323,1.1.1_mr4_build_8.1.1.329,1.1.1_mr5_build_8.1.1.336,1.1.1_mr6_b8.1.1.266,1.1_stm_b8.1.0.825a,2.0,2.0.1,2.0.1_build_9.0.1.1000:mr1,2.0.2,2.0.2_build_9.0.2.1000:mr2,2.0.3,2.0.3_build_9.0.3.1000:mr3,2.0_scf_7.1,2.0_stm_build_9.0.0.338; Upgrade symantec norton_antivirus to a higher version than 8.1,8.1.0.825a,8.1.1,8.1.1.319,8.1.1.323,8.1.1.329,8.1.1.366,8.1.1.377,8.1.1_build8.1.1.314a,8.1.1_build393,8.01.434,8.01.437,8.01.446,8.01.457,8.01.460,8.01.464,8.01.471,9.0.1,9.0.1.1.1000,9.0.1.1000,9.0.2,9.0.2.1000,and avoid the version 8.1,8.1.0.825a,8.1.1,8.1.1.319,8.1.1.323,8.1.1.329,8.1.1.366,8.1.1.377,8.1.1_build8.1.1.314a,8.1.1_build393,8.01.434,8.01.437,8.01.446,8.01.457,8.01.460,8.01.464,8.01.471,9.0.1,9.0.1.1.1000,9.0.1.1000,9.0.2,9.0.2.1000