Read the docs
TI-2006-03348 Aliases CVE-2006-3455GHSA-726x-q3rw-h4cp

The SAVRT.SYS device driver, as used in Symantec AntiVirus Corporate Edition 8.1 and…

Priority LOW 20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The SAVRT.SYS device driver, as used in Symantec AntiVirus Corporate Edition 8.1 and 9.0.x up to 9.0.3, and Symantec Client Security 1.1 and 2.0.x up to 2.0.3, allows local users to execute arbitrary code via a modified address for the output buffer argument to the DeviceIOControl function.

Why it matters now

EPSS 0.00382 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 41

CPEVersionsRoleVendor
cpe:2.3:a:symantec:client_security:1.1:*:*:*:*:*:*:*1.1VulnerableSymantec
cpe:2.3:a:symantec:client_security:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableSymantec
cpe:2.3:a:symantec:client_security:1.1.1_build_393:*:*:*:*:*:*:*1.1.1_build_393VulnerableSymantec
cpe:2.3:a:symantec:client_security:1.1.1_mr1_build_8.1.1.314a:*:*:*:*:*:*:*1.1.1_mr1_build_8.1.1.314aVulnerableSymantec
cpe:2.3:a:symantec:client_security:1.1.1_mr2_build_8.1.1.319:*:*:*:*:*:*:*1.1.1_mr2_build_8.1.1.319VulnerableSymantec
cpe:2.3:a:symantec:client_security:1.1.1_mr3_build_8.1.1.323:*:*:*:*:*:*:*1.1.1_mr3_build_8.1.1.323VulnerableSymantec
cpe:2.3:a:symantec:client_security:1.1.1_mr4_build_8.1.1.329:*:*:*:*:*:*:*1.1.1_mr4_build_8.1.1.329VulnerableSymantec
cpe:2.3:a:symantec:client_security:1.1.1_mr5_build_8.1.1.336:*:*:*:*:*:*:*1.1.1_mr5_build_8.1.1.336VulnerableSymantec
cpe:2.3:a:symantec:client_security:1.1.1_mr6_b8.1.1.266:*:*:*:*:*:*:*1.1.1_mr6_b8.1.1.266VulnerableSymantec
cpe:2.3:a:symantec:client_security:1.1_stm_b8.1.0.825a:*:*:*:*:*:*:*1.1_stm_b8.1.0.825aVulnerableSymantec
  • cpe:2.3:a:symantec:client_security:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:1.1.1_build_393:*:*:*:*:*:*:* Versions 1.1.1_build_393 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:1.1.1_mr1_build_8.1.1.314a:*:*:*:*:*:*:* Versions 1.1.1_mr1_build_8.1.1.314a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:1.1.1_mr2_build_8.1.1.319:*:*:*:*:*:*:* Versions 1.1.1_mr2_build_8.1.1.319 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:1.1.1_mr3_build_8.1.1.323:*:*:*:*:*:*:* Versions 1.1.1_mr3_build_8.1.1.323 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:1.1.1_mr4_build_8.1.1.329:*:*:*:*:*:*:* Versions 1.1.1_mr4_build_8.1.1.329 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:1.1.1_mr5_build_8.1.1.336:*:*:*:*:*:*:* Versions 1.1.1_mr5_build_8.1.1.336 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:1.1.1_mr6_b8.1.1.266:*:*:*:*:*:*:* Versions 1.1.1_mr6_b8.1.1.266 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:1.1_stm_b8.1.0.825a:*:*:*:*:*:*:* Versions 1.1_stm_b8.1.0.825a Vulnerable ·Symantec
Show 31 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:symantec:client_security:2.0:*:*:*:*:*:*:*2.0VulnerableSymantec
cpe:2.3:a:symantec:client_security:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableSymantec
cpe:2.3:a:symantec:client_security:2.0.1_build_9.0.1.1000:mr1:*:*:*:*:*:*2.0.1_build_9.0.1.1000 mr1VulnerableSymantec
cpe:2.3:a:symantec:client_security:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableSymantec
cpe:2.3:a:symantec:client_security:2.0.2_build_9.0.2.1000:mr2:*:*:*:*:*:*2.0.2_build_9.0.2.1000 mr2VulnerableSymantec
cpe:2.3:a:symantec:client_security:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableSymantec
cpe:2.3:a:symantec:client_security:2.0.3_build_9.0.3.1000:mr3:*:*:*:*:*:*2.0.3_build_9.0.3.1000 mr3VulnerableSymantec
cpe:2.3:a:symantec:client_security:2.0_scf_7.1:*:*:*:*:*:*:*2.0_scf_7.1VulnerableSymantec
cpe:2.3:a:symantec:client_security:2.0_stm_build_9.0.0.338:*:*:*:*:*:*:*2.0_stm_build_9.0.0.338VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.1:*:corporate:*:*:*:*:*8.1VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.1.0.825a:*:corporate:*:*:*:*:*8.1.0.825aVulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.1.1:*:corporate:*:*:*:*:*8.1.1VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.1.1.319:*:corporate:*:*:*:*:*8.1.1.319VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.1.1.323:*:corporate:*:*:*:*:*8.1.1.323VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.1.1.329:*:corporate:*:*:*:*:*8.1.1.329VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.1.1.366:*:corporate:*:*:*:*:*8.1.1.366VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.1.1.377:*:corporate:*:*:*:*:*8.1.1.377VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.1.1_build8.1.1.314a:*:corporate:*:*:*:*:*8.1.1_build8.1.1.314aVulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.1.1_build393:*:corporate:*:*:*:*:*8.1.1_build393VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.01.434:*:corporate:*:*:*:*:*8.01.434VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.01.437:*:corporate:*:*:*:*:*8.01.437VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.01.446:*:corporate:*:*:*:*:*8.01.446VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.01.457:*:corporate:*:*:*:*:*8.01.457VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.01.460:*:corporate:*:*:*:*:*8.01.460VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.01.464:*:corporate:*:*:*:*:*8.01.464VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:8.01.471:*:corporate:*:*:*:*:*8.01.471VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:9.0.1:*:corporate:*:*:*:*:*9.0.1VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:9.0.1.1.1000:*:corporate:*:*:*:*:*9.0.1.1.1000VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:9.0.1.1000:*:corporate:*:*:*:*:*9.0.1.1000VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:9.0.2:*:corporate:*:*:*:*:*9.0.2VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:9.0.2.1000:*:corporate:*:*:*:*:*9.0.2.1000VulnerableSymantec
  • cpe:2.3:a:symantec:client_security:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:2.0.1_build_9.0.1.1000:mr1:*:*:*:*:*:* Versions 2.0.1_build_9.0.1.1000 mr1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:2.0.2_build_9.0.2.1000:mr2:*:*:*:*:*:* Versions 2.0.2_build_9.0.2.1000 mr2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:2.0.3_build_9.0.3.1000:mr3:*:*:*:*:*:* Versions 2.0.3_build_9.0.3.1000 mr3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:2.0_scf_7.1:*:*:*:*:*:*:* Versions 2.0_scf_7.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:client_security:2.0_stm_build_9.0.0.338:*:*:*:*:*:*:* Versions 2.0_stm_build_9.0.0.338 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.1:*:corporate:*:*:*:*:* Versions 8.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.1.0.825a:*:corporate:*:*:*:*:* Versions 8.1.0.825a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.1.1:*:corporate:*:*:*:*:* Versions 8.1.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.1.1.319:*:corporate:*:*:*:*:* Versions 8.1.1.319 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.1.1.323:*:corporate:*:*:*:*:* Versions 8.1.1.323 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.1.1.329:*:corporate:*:*:*:*:* Versions 8.1.1.329 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.1.1.366:*:corporate:*:*:*:*:* Versions 8.1.1.366 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.1.1.377:*:corporate:*:*:*:*:* Versions 8.1.1.377 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.1.1_build8.1.1.314a:*:corporate:*:*:*:*:* Versions 8.1.1_build8.1.1.314a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.1.1_build393:*:corporate:*:*:*:*:* Versions 8.1.1_build393 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.01.434:*:corporate:*:*:*:*:* Versions 8.01.434 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.01.437:*:corporate:*:*:*:*:* Versions 8.01.437 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.01.446:*:corporate:*:*:*:*:* Versions 8.01.446 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.01.457:*:corporate:*:*:*:*:* Versions 8.01.457 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.01.460:*:corporate:*:*:*:*:* Versions 8.01.460 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.01.464:*:corporate:*:*:*:*:* Versions 8.01.464 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:8.01.471:*:corporate:*:*:*:*:* Versions 8.01.471 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:9.0.1:*:corporate:*:*:*:*:* Versions 9.0.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:9.0.1.1.1000:*:corporate:*:*:*:*:* Versions 9.0.1.1.1000 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:9.0.1.1000:*:corporate:*:*:*:*:* Versions 9.0.1.1000 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:9.0.2:*:corporate:*:*:*:*:* Versions 9.0.2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:9.0.2.1000:*:corporate:*:*:*:*:* Versions 9.0.2.1000 Vulnerable ·Symantec

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-3455
  2. 2026-10-03 Alias added: GHSA-726x-q3rw-h4cp

References

Patch 1

Other 1

  • TI-2009-01353 The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2)… CVSS 2.0HIGH 10.0
  • TI-2006-02539 Stack-based buffer overflow in Symantec Antivirus 10.1 and Client Security 3.1 allows… CVSS 2.0HIGH 10.0
  • TI-2009-01354 Multiple stack-based buffer overflows in IAO.EXE in the Intel Alert Originator Service in… CVSS 2.0HIGH 9.3
  • TI-2010-00103 Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy… CVSS 2.0HIGH 10.0
  • TI-2004-00401 Multiple vulnerabilities in SYMDNS.SYS for Symantec Norton Internet Security and… CVSS 2.0HIGH 10.0
  • TI-2009-01355 XFR.EXE in the Intel File Transfer service in the console in Symantec Alert Management… CVSS 2.0HIGH 9.3
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences