CVE-2006-3456 describes a critical vulnerability in the Symantec NAVOPTS.DLL ActiveX control, affecting Norton AntiVirus, Internet Security, and System Works 2005 and 2006. This flaw allows remote attackers to crash the control and place Internet Explorer into a "defunct state," enabling arbitrary code execution and manipulation of other Symantec ActiveX controls, even if not marked safe for scripting. With a CVSS score of 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C), this vulnerability poses a high risk due to its network-based attack vector, medium complexity, and complete impact on confidentiality, integrity, and availability. While no public exploits (Metasploit, Nuclei, ExploitDB) are listed and there's minimal community discussion or media coverage, its high FAUCET Risk Score of 81/100 indicates significant potential danger.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2005CPE matchmatch criteria | cpe:2.3:a:symantec:norton_antivirus:2005:*:*:*:*:*:*:* | ||
2006CPE matchmatch criteria | cpe:2.3:a:symantec:norton_antivirus:2006:*:*:*:*:*:*:* | ||
2005CPE matchmatch criteria | cpe:2.3:a:symantec:norton_internet_security:2005:*:*:*:*:*:*:* | ||
2006CPE matchmatch criteria | cpe:2.3:a:symantec:norton_internet_security:2006:*:*:*:*:*:*:* | ||
2005CPE matchmatch criteria | cpe:2.3:a:symantec:norton_system_works:2005:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:S/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.