CVE-2016-3645
📋 TL;DR
This integer overflow vulnerability in Symantec's TNEF unpacker allows remote attackers to execute arbitrary code via specially crafted TNEF data. It affects numerous Symantec security products across Windows, Mac, and Linux platforms. Attackers can exploit this without authentication to potentially take full control of affected systems.
💻 Affected Systems
- Symantec Advanced Threat Protection (ATP)
- Symantec Data Center Security:Server (SDCS:S)
- Symantec Web Gateway
- Symantec Endpoint Protection (SEP)
- Symantec Endpoint Protection (SEP) for Mac
- Symantec Endpoint Protection (SEP) for Linux
- Symantec Protection Engine (SPE)
- Symantec Protection for SharePoint Servers (SPSS)
- Symantec Mail Security for Microsoft Exchange (SMSMSE)
- Symantec Mail Security for Domino (SMSDOM)
- CSAPI
- Symantec Message Gateway (SMG)
- Symantec Message Gateway for Service Providers (SMG-SP)
- Norton AntiVirus
- Norton Security
- Norton Internet Security
- Norton 360
- Norton Security for Mac
- Norton Power Eraser (NPE)
- Norton Bootable Removal Tool (NBRT)
📦 What is this software?
Csapi by Symantec
Mail Security For Microsoft Exchange by Symantec
View all CVEs affecting Mail Security For Microsoft Exchange →
Mail Security For Microsoft Exchange by Symantec
View all CVEs affecting Mail Security For Microsoft Exchange →
Mail Security For Microsoft Exchange by Symantec
View all CVEs affecting Mail Security For Microsoft Exchange →
Message Gateway For Service Providers by Symantec
View all CVEs affecting Message Gateway For Service Providers →
Message Gateway For Service Providers by Symantec
View all CVEs affecting Message Gateway For Service Providers →
Ngc by Symantec
Norton 360 by Symantec
Protection For Sharepoint Servers by Symantec
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution allowing attackers to install malware, create backdoors, or exfiltrate sensitive data.
If Mitigated
Denial of service or application crash if exploit fails or controls limit impact.
🎯 Exploit Status
Public exploit available on Exploit-DB (ID 40035). Crafted TNEF data can be delivered via email attachments or other vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Varies by product - see vendor advisory for specific version requirements
Vendor Advisory: https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00
Restart Required: Yes
Instructions:
1. Identify affected Symantec products and versions. 2. Download and apply appropriate patches from Symantec. 3. Restart affected services or systems as required. 4. Verify patch installation.
🔧 Temporary Workarounds
Block TNEF attachments at perimeter
allConfigure email gateways to block or quarantine TNEF attachments (.dat files with winmail.dat content-type)
Disable TNEF processing
allIf supported by specific Symantec product, disable TNEF unpacking functionality
🧯 If You Can't Patch
- Isolate affected systems from untrusted networks
- Implement strict network segmentation and monitor for exploit attempts
🔍 How to Verify
Check if Vulnerable:
Check installed Symantec product versions against affected ranges in vendor advisoryCheck Version:
Varies by product - typically via product console or 'symantec-version' commandVerify Fix Applied:
Verify product version is updated to patched version and check for successful update in logs📡 Detection & Monitoring
Log Indicators:
- Symantec service crashes
- Unexpected process creation from Symantec services
- Memory access violations in Symantec logs
Network Indicators:
- Inbound emails with TNEF attachments
- Network traffic to/from Symantec services on unusual ports
SIEM Query:
source="symantec*" AND (event_type="crash" OR event_type="exception")🔗 References
- http://www.securityfocus.com/bid/91439
- http://www.securitytracker.com/id/1036198
- http://www.securitytracker.com/id/1036199
- https://www.exploit-db.com/exploits/40035/
- https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00
- http://www.securityfocus.com/bid/91439
- http://www.securitytracker.com/id/1036198
- http://www.securitytracker.com/id/1036199
- https://www.exploit-db.com/exploits/40035/
- https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00
