August 2005

ID: 00734
Ref: 681/2005
Date: 26 August 2005:13:09:34
Version: 1

---

Title: Symantec AntiVirus Corporate Edition 9.0 and Symantec Client Security 2.0 Help File Elevation of Privilege
Abstract: Details of a new vulnerability released by Symantec
Vendors affected: Symantec
Operating systems affected: Symantec
Applications affected: Symantec

---

A vulnerability has been identified in the Symantec AntiVirus Corporate Edition
HTML client help function that uses HTML help, the Windows help interface, to
provide support to the client user.

A non-privileged client user can manipulate the help function to access files
on the system with local SYSTEM privileges.

Further details can be found at:
http://securityresponse.symantec.com/avcenter/security/Content/2005.08.24.html