Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Local
0

CVE-2016-5310

Disclosure Date: April 14, 2017 •
CVE-2016-5310 CVSS v3 Base Score: 5.5
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud; Symantec Data Center Security: Server; Symantec Endpoint Protection (SEP) for Windows before 12.1.6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1.6 MP6; Symantec Endpoint Protection for Small Business Enterprise (SEP SBE/SEP.Cloud); Symantec Endpoint Protection Cloud (SEPC) for Windows/Mac; Symantec Endpoint Protection Small Business Edition 12.1; CSAPI before 10.0.4 HF02; Symantec Protection Engine (SPE) before 7.0.5 HF02, 7.5.x before 7.5.4 HF02, 7.5.5 before 7.5.5 HF01, and 7.8.x before 7.8.0 HF03; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF2.1, 8.1.x before 8.1.2 HF2.3, and 8.1.3 before 8.1.3 HF2.2; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 6.5.8_3968140 HF2.3, 7.x before 7.0_3966002 HF2.1, and 7.5.x before 7.5_3966008 VHF2.2; Symantec Protection for SharePoint Servers (SPSS) before SPSS_6.0.3_To_6.0.5_HF_2.5 update, 6.0.6 before 6.0.6 HF_2.6, and 6.0.7 before 6.0.7_HF_2.7; Symantec Messaging Gateway (SMG) before 10.6.2; Symantec Messaging Gateway for Service Providers (SMG-SP) before 10.5 patch 260 and 10.6 before patch 259; Symantec Web Gateway; and Symantec Web Security.Cloud allows remote attackers to cause a denial of service (memory corruption) via a crafted RAR file that is mishandled during decompression.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
5.5 Medium
Impact Score:
3.6
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
None
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
n/a
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • broadcom,
  • symantec

Products

  • advanced threat protection -,
  • csapi,
  • email security.cloud -,
  • endpoint protection,
  • endpoint protection cloud -,
  • endpoint protection for small business,
  • endpoint protection for small business -,
  • mail security for domino,
  • mail security for domino 8.1.2,
  • mail security for domino 8.1.3,
  • mail security for microsoft exchange,
  • mail security for microsoft exchange 7.0,
  • mail security for microsoft exchange 7.0.1,
  • mail security for microsoft exchange 7.0.2,
  • mail security for microsoft exchange 7.0.3,
  • mail security for microsoft exchange 7.0.4,
  • mail security for microsoft exchange 7.5,
  • mail security for microsoft exchange 7.5.1,
  • mail security for microsoft exchange 7.5.2,
  • mail security for microsoft exchange 7.5.3,
  • mail security for microsoft exchange 7.5.4,
  • messaging gateway,
  • messaging gateway for service providers 10.5,
  • messaging gateway for service providers 10.6,
  • protection engine,
  • protection engine 7.5.0,
  • protection engine 7.5.1,
  • protection engine 7.5.2,
  • protection engine 7.5.3,
  • protection engine 7.5.4,
  • protection engine 7.5.5,
  • protection engine 7.8.0,
  • protection for sharepoint servers 6.0.3,
  • protection for sharepoint servers 6.0.4,
  • protection for sharepoint servers 6.0.5,
  • protection for sharepoint servers 6.0.6,
  • protection for sharepoint servers 6.0.7,
  • symantec data center security server -,
  • web gateway -,
  • web security.cloud -
Technical Analysis