CVE:CVE-2007-3673
CNNVD:CNNVD-200707-277
Symantec AntiVirus是非常流行的杀毒解决方案。
Symantec AntiVirus的驱动在处理特定参数时存在漏洞，本地攻击者可能利用此漏洞控制系统。
Symantec杀毒软件所使用的\\symTDI\设备驱动在处理IOCTL 0x83022323时没有正确地验证地址空间，如果本地攻击者向IOCTL处理函数提交了特制IRP参数的话，就可能导致覆盖内存，以内核权限执行任意指令。
solution:Upgrade symantec client_security to a higher version than 2.0,3.0,3.1,and avoid the version 2.0,3.0,3.1; Upgrade symantec norton_antispam to a higher version than 2005,and avoid the version 2005; Upgrade symantec norton_antivirus to a higher version than 9.0,9.0.0.338,9.0.1,9.0.1.1.1000,9.0.1.1000,9.0.2,9.0.2.1000,9.0.3.1000,9.0.4,9.0.5,9.0.5.1100,10.0,10.1,2005,2006,and avoid the version 9.0,9.0.0.338,9.0.1,9.0.1.1.1000,9.0.1.1000,9.0.2,9.0.2.1000,9.0.3.1000,9.0.4,9.0.5,9.0.5.1100,10.0,10.1,2005,2006; Upgrade symantec norton_internet_security to a higher version than 2005,2006,and avoid the version 2005,2006; Upgrade symantec norton_personal_firewall to a higher version than 2005,2006,and avoid the version 2005,2006; Upgrade symantec norton_system_works to a higher version than 2005,2006,and avoid the version 2005,2006