===================================================0D
    Layered Defense Advisory 13 September 2006=0D
===================================================0D
1) Affected Software =0D
Symantec AntiVirus Corporate Edition 10.0=0D
Symantec AntiVirus Corporate Edition  9.0=0D
Symantec AntiVirus Corporate Edition  8.1 ===================================================0D
2) Severity =0D
Rating: Medium risk=0D
Impact: Execution of arbitrary code, rights escalation and at a minimum, denial of service.=0D
===================================================0D
3) Description of Vulnerability =0D
A format string vulnerability was discovered within Symantec AntiVirus Corporate Edition. The vulnerability is due to improper processing of format strings within Tamper Protection and Virus Alert Notification message fields. A local user could replace the Tamper Protection and Virus Alert Notification messages with a specially crafted format string which could allow access to the process stack. If successfully exploited, this could allow the user to execute code of the attacker=92s choice with elevated privileges, on the local system.=0D
Other effected software identified by vendor:=0D
Symantec Client Security 3.0=0D
Symantec Client Security 2.x=0D
Symantec Client Security 1.x=0D
=0D
===================================================0D
4) Solution=0D
 =0D
Solutions to fix vulnerability are addressed within Symantec Advisory =0D
http://www.symantec.com/avcenter/security/Content/2006.09.13.html=0D 
===================================================0D
5) Time Table =0D
01/08/2006 =96 Reported Vulnerability to Vendor. =0D
09/13/2006 =96 Vendor Public disclosure. =0D
===================================================0D
6) Credits =0D
Discovered by Deral Heiland, www.LayeredDefense.com ===================================================0D 
7) References =0D
CVE Reference: =0D
CVE-2006-3454 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3454=0D 
===================================================0D
9) About Layered Defense =0D
Layered Defense, Is a group of security professionals that work together on ethical Research, Testing and Training within the information security arena.=0D
http://www.layereddefense.com=0D 
================================================== =0D
=0D