search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Symantec products fail to properly limit device driver access to kernel memory

Vulnerability Note VU#946820

Original Release Date: 2006-10-10 | Last Revised: 2006-10-11


Certain device drivers included with Symantec products fail to properly verify address space within the "IOCTL" handlers.


Symantec provides Anti-Virus and Internet Security products that are designed to protect users. According to Symantec Security Response SYM06-020:

A specially crafted IRP could be sent to the IOCTL handler function which could allow memory to be overwritten because the address space was not properly validated.
The device drivers NAVENG and NAVEX15 improperly validate address space when processing IOCTL 0x222AD3, 0x222AD7, and 0x222ADB. A specially crafted I/O request packet (IRP) to the IOCTL handler function could overwrite a user supplied address with a constant double word value. Note that this vulnerability only affects the Symantec and Norton anti-virus products for Windows NT, Windows 2000, and Windows XP.


This vulnerability could allow a local attacker to execute arbitrary code with kernel level privileges.


Symantec has addressed this issue with new virus definitions as specified in Symantec Security Response SYM06-020.

Vendor Information

Affected   Unknown   Unaffected

Symantec, Inc.

Updated:  October 10, 2006



Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Refer to SYM06-020.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A



This issue was reported in Symantec Security Response SYM06-020 Symantec credits Ruben Santamarta working with the iDefense Vulnerability Contributor Program for reporting this issue.

This document was written by Chris Taschner.

Other Information

CVE IDs: CVE-2006-4927
Severity Metric: 3.99
Date Public: 2006-10-06
Date First Published: 2006-10-10
Date Last Updated: 2006-10-11 14:10 UTC
Document Revision: 11

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.