CVE-2009-1428 (GCVE-0-2009-1428)
Vulnerability from cvelistv5 – Published: 2009-04-29 15:00 – Updated: 2024-08-07 05:13
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in ccLgView.exe in the Symantec Log Viewer, as used in Symantec AntiVirus (SAV) before 10.1 MR8, Symantec Endpoint Protection (SEP) 11.0 before 11.0 MR1, Norton 360 1.0, and Norton Internet Security 2005 through 2008, allow remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, related to "two parsing errors."
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T05:13:25.574Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "multiple-symantec-log-xss(50170)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50170"
},
{
"name": "ADV-2009-1203",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/1203"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=2009\u0026suid=20090428_01"
},
{
"name": "34669",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/34669"
},
{
"name": "1022135",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1022135"
},
{
"name": "1022134",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1022134"
},
{
"name": "1022133",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1022133"
},
{
"name": "34936",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34936"
},
{
"name": "54132",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/54132"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-04-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in ccLgView.exe in the Symantec Log Viewer, as used in Symantec AntiVirus (SAV) before 10.1 MR8, Symantec Endpoint Protection (SEP) 11.0 before 11.0 MR1, Norton 360 1.0, and Norton Internet Security 2005 through 2008, allow remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, related to \"two parsing errors.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "multiple-symantec-log-xss(50170)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50170"
},
{
"name": "ADV-2009-1203",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/1203"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=2009\u0026suid=20090428_01"
},
{
"name": "34669",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/34669"
},
{
"name": "1022135",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1022135"
},
{
"name": "1022134",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1022134"
},
{
"name": "1022133",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1022133"
},
{
"name": "34936",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34936"
},
{
"name": "54132",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/54132"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-1428",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in ccLgView.exe in the Symantec Log Viewer, as used in Symantec AntiVirus (SAV) before 10.1 MR8, Symantec Endpoint Protection (SEP) 11.0 before 11.0 MR1, Norton 360 1.0, and Norton Internet Security 2005 through 2008, allow remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, related to \"two parsing errors.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "multiple-symantec-log-xss(50170)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50170"
},
{
"name": "ADV-2009-1203",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/1203"
},
{
"name": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=2009\u0026suid=20090428_01",
"refsource": "CONFIRM",
"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=2009\u0026suid=20090428_01"
},
{
"name": "34669",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/34669"
},
{
"name": "1022135",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1022135"
},
{
"name": "1022134",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1022134"
},
{
"name": "1022133",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1022133"
},
{
"name": "34936",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34936"
},
{
"name": "54132",
"refsource": "OSVDB",
"url": "http://osvdb.org/54132"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-1428",
"datePublished": "2009-04-29T15:00:00",
"dateReserved": "2009-04-24T00:00:00",
"dateUpdated": "2024-08-07T05:13:25.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2009-1428\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2009-04-29T15:30:00.203\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple cross-site scripting (XSS) vulnerabilities in ccLgView.exe in the Symantec Log Viewer, as used in Symantec AntiVirus (SAV) before 10.1 MR8, Symantec Endpoint Protection (SEP) 11.0 before 11.0 MR1, Norton 360 1.0, and Norton Internet Security 2005 through 2008, allow remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, related to \\\"two parsing errors.\\\"\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en ccLgView.exe en Symantec Log Viewer, utilizado en Symantec AntiVirus (SAV), anterior a v10.1 MR8, Symantec Endpoint Protection (SEP) v11.0 anteriores a v11.0 MR1, Norton 360 v1.0, y Norton Internet Security 2005 hasta 2008, permite a atacantes remotos inyectar HTML o scripts web arbitrarios a su elecci\u00f3n a trav\u00e9s de un mensaje de correo electr\u00f3nico elaborado ,relacionadas con \\\"dos errores de an\u00e1lisis sint\u00e1ctico.\\\"\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"10.1\",\"matchCriteriaId\":\"B5F1EF45-537A-4656-BDE8-FA9383A75676\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E02FE2FB-514A-48F9-8833-B1EF4CC1E27E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD10A73-3DEF-48BD-9B35-D2BF791560E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"03684DB6-9DC6-4EDD-902F-D1EC160330ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"64D38110-4B50-472E-9743-52A137F2ED93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1004A37-D22B-4690-8625-B631595C8B0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE7A5EDA-F1FF-4F66-BC78-DC6429D301CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A664090-5993-4DF2-AD6B-0F4867DB98B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"079D24C8-27D6-4794-8E56-58A7885DFE87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"732CB44D-7468-486A-85CA-FA1365DB0F8A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E236C99A-D524-462A-BD8E-97A07B3BFC69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"37456791-164A-489B-A905-8B61C6F91BAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C39155B8-55BD-4B58-85DB-505876930A1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:antivirus:10.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"287B278D-A114-4795-8934-64E3C4472481\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:endpoint_protection:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E269D396-3A70-4C4B-9D79-CBBA75C280D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_360:1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"00819E08-CC5C-48FC-9F80-95B68AB19C65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_internet_security:2005:*:anti_spyware:*:*:*:*:*\",\"matchCriteriaId\":\"803641B7-E099-4CE8-B805-DBB338479E23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_internet_security:2005:*:professional:*:*:*:*:*\",\"matchCriteriaId\":\"E4BBE123-56E1-46E0-93BE-38F0932D9C63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_internet_security:2005:11.0:*:*:*:*:*:*\",\"matchCriteriaId\":\"F39AE3D7-7018-47AB-B332-D40EA5273CEC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_internet_security:2005:11.0.9:*:*:*:*:*:*\",\"matchCriteriaId\":\"82446BA3-92F9-4689-9D67-3CE159AA0F49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_internet_security:2005:11.5.6.14:*:*:*:*:*:*\",\"matchCriteriaId\":\"98F9F2E3-1775-4EF9-9FE0-0D011307C269\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_internet_security:2005_contains_nav_11.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7FE1A0A-4352-459A-892D-29AB14AA3B00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_internet_security:2006:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1CC64B1-772C-42A9-9B0A-08CA92DC87E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_internet_security:2006:*:professional:*:*:*:*:*\",\"matchCriteriaId\":\"1DE91FB9-35C3-4DC7-BE00-7C60EE9FD880\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_internet_security:2007:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"692ECBCD-AB6B-4965-93F4-BDAD4777C018\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symantec:norton_internet_security:2008:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF87752-C86D-4C89-9DE9-F874068C89EC\"}]}]}],\"references\":[{\"url\":\"http://osvdb.org/54132\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/34936\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/34669\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id?1022133\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id?1022134\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id?1022135\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=2009\u0026suid=20090428_01\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/1203\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/50170\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/54132\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/34936\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/34669\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id?1022133\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id?1022134\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id?1022135\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=2009\u0026suid=20090428_01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/1203\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/50170\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…