This host is installed with Symantec Norton AntiVirus and is prone to remote code execution vulnerability.

Successful exploitation could allow the attackers to bypass the protection of AntiVirus technology and allows an attacker to drop and execute known malicious files. Impact Level: Application

No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.

Symantec Norton AntiVirus fails to process 'hcp://' URLs by the Microsoft Help and Support Center, which allows attackers to execute malicious code via a protocol handler (hcp).

Symantec Norton Antivirus 2011 NOTE: the researcher indicates that a vendor response was received, stating that this issue 'falls into the work of our Firewall and not our AV (per our methodology of layers of defense).'

• http://osvdb.org/75186
• http://seclists.org/fulldisclosure/2010/Oct/274
• http://www.n00bz.net/antivirus-cve
• http://www.securityfocus.com/archive/1/514356

---

Updated on 2015-03-25