CVE:CVE-2009-1430
CNNVD:CNNVD-200904-540
Symantec AntiVirus是非常流行的杀毒解决方案。
Symantec杀毒软件中的Intel Alert Originator服务(IAO.EXE)没有正确地验证通过memcpy()调用发送给栈缓冲区的数据。如果远程攻击者向默认监听的TCP 38292端口发送了畸形报文的话，就可以触发栈溢出，导致以SYSTEM权限执行任意代码。
solution:Upgrade symantec antivirus to a higher version than 9.0,10.1,10.2,-,10.0,10.0.1,10.0.1.1,10.0.2,10.0.2.1,10.0.2.2,10.0.3,10.0.4,10.0.5,10.0.6,10.0.7,10.0.8,10.0.9,and avoid the version (,9.0],(,10.1],(,10.2],10.0,10.0.1,10.0.1.1,10.0.2,10.0.2.1,10.0.2.2,10.0.3,10.0.4,10.0.5,10.0.6,10.0.7,10.0.8,10.0.9; Upgrade symantec antivirus_central_quarantine_server to a higher version than *; Upgrade symantec client_security to a higher version than 3.1,2.0,3.0,3.0.0.359,3.0.1.1000,3.0.1.1001,3.0.1.1007,3.0.1.1008,3.0.1.1009,3.0.2,3.0.2.2000,3.0.2.2001,3.0.2.2002,3.0.2.2010,3.0.2.2011,3.0.2.2020,3.0.2.2021,and avoid the version (,3.1],2.0,3.0,3.0.0.359,3.0.1.1000,3.0.1.1001,3.0.1.1007,3.0.1.1008,3.0.1.1009,3.0.2,3.0.2.2000,3.0.2.2001,3.0.2.2002,3.0.2.2010,3.0.2.2011,3.0.2.2020,3.0.2.2021; Upgrade symantec endpoint_protection to a higher version than 11.0,and avoid the version (,11.0]; Upgrade symantec system_center to a higher version than *