CVE-2007-1793: Symantec Antivirus

Medium severity, CVSS 4.9. EPSS: 1.7% chance of exploitation in the next 30 days.

SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service (crash) or possibly execute arbitrary code via crafted arguments to the (1) NtCreateMutant and (2) NtOpenEvent functions. NOTE: it was later reported that Norton Internet Security 2008 15.0.0.60, and possibly other versions back to 2006, are also affected.

Affected products

• Symantec Antivirus: version 10.0 only; version 10.0.1 only; version 10.0.1.1 only; version 10.0.2 only; version 10.0.2.1 only; version 10.0.2.2 only; …
• Symantec Client Security: version 3.0 only; version 3.0.0.359 only; version 3.0.1.1000 only; version 3.0.1.1001 only; version 3.0.1.1007 only; version 3.0.1.1008 only; …
• Symantec Norton 360: version 1.0 only
• Symantec Norton Antispam: version 2004 only; version 2005 only
• Symantec Norton Antivirus: version 2004 only; version 2005 only; version 2006 only; version 2007 only; version 2008 only
• Symantec Norton Internet Security: version 2004 only; version 2005 only; version 2006 only; version 2007 only; version 2008 only
• Symantec Norton Personal Firewall: version 2004 only; version 2005 only; version 2006 only; version 2006_9.1.0.33 only; version 2006_9.1.1.7 only
• Symantec Norton System Works: version 2004 only; version 2005 only; version 2006 only

Published 2007-04-02. Last modified 2026-06-16.