dbcve.org
AntivirusApplication · Symantec

CVE-2012-4953

HIGH · 9.3 CVSS v2.0 Published 2012-11-14
Fix available
A fix is available. Upgrade to after 5.2 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVirus Corporate Edition (SAVCE) 10.x, and Symantec Scan Engine (SSE) before 5.2.8 does not properly perform bounds checks of the contents of CAB archives, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Buffer overflow vulnerability in the decomposer engine of multiple Symantec security products (Endpoint Protection 11.0, SEP Small Business Edition 12.0, SAVCE 10.x, Scan Engine before 5.2.8) due to insufficient bounds checking when parsing CAB archive files, allowing remote attackers to cause denial of service or potentially execute arbitrary code via crafted CAB archives.

MitigationApply vendor security patches (SEP 11.0, SEP SBE 12.0, SAVCE 10.x, SSE 5.2.8 or later) to address the improper bounds checking in the CAB decomposer engine, or disable CAB archive scanning until patches can be deployed.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
AntivirusApplication
Affected:= 10.1.0= 10.1.4= 10.1.5= 10.1.6= 10.1.7= 10.1.8= 10.1.9
Endpoint ProtectionApplication
Affected:= 11.0= 12.0
Scan EngineApplication
Affected:<= 5.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
M
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed Symantec product and version
    Open the Symantec product interface (Symantec Endpoint Protection, Symantec Antivirus, or Scan Engine) and navigate to Help > About, or check the installed programs list in Windows Control Panel to locate the exact product name and version number
    Affected if The product is one of: Symantec Antivirus 10.1.0, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.1.8, or 10.1.9; Symantec Endpoint Protection 11.0 or 12.0; or Symantec Scan Engine version 5.2 or earlier
  2. Confirm CAB archive scanning is enabled
    Access the product's scan settings or policy configuration. For Endpoint Protection, open the SEP Manager or client and check the scan policy for archive scanning. For SAVCE, check the Scan Options or Configure > Scanning settings. Verify that scanning of CAB files is not explicitly disabled
    Affected if CAB archive scanning is enabled or set to the default (enabled), allowing the decomposer engine to process CAB files
  3. Verify the decomposer engine is active
    Check the real-time or on-demand scan configuration to confirm the CAB file type is included in the scan scope. In the product's scanning preferences, ensure .cab files are listed as a scanned archive type
    Affected if CAB files are included in the archive types being scanned by the decomposer engine

Your environment is affected if you have any of the listed product versions installed with CAB archive scanning enabled, as the decomposer engine will attempt to parse crafted CAB files.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 5.2
Interim mitigation

Apply vendor security patches (SEP 11.0, SEP SBE 12.0, SAVCE 10.x, SSE 5.2.8 or later) to address the improper bounds checking in the CAB decomposer engine, or disable CAB archive scanning until patches can be deployed.

Recommended fix Moderate confidence

Symantec Scan Engine 5.2.8 or later; Contact Symantec for specific patches for Endpoint Protection 11.0/12.0 and SAVCE 10.x

  1. 1. Identify the specific Symantec product in use (Endpoint Protection, Antivirus Corporate Edition, or Scan Engine)
  2. 2. For Symantec Scan Engine: Upgrade to version 5.2.8 or later which contains the bounds checking fix for CAB archive handling
  3. 3. For Endpoint Protection 11.0 and 12.0: Contact Symantec support to obtain the applicable patch for this vulnerability
  4. 4. For Symantec AntiVirus Corporate Edition 10.x: Contact Symantec support for available patches addressing this decomposer engine vulnerability
  5. 5. After upgrading, verify the fix by testing with the crafted CAB file or using Symantec's security update verification tools
  6. 6. Ensure the definitions are updated after applying the fix

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Antivirus Scoped from the published advisory
  • Consultation2.0 h
  • Implementation3.0 h
  • Testing2.0 h
  • Review / QA1.0 h
8.0 hours of engineering $1,420
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,272.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2012-4953 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2012-4953 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data