CVE-2004-0444

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-07-07 · updated 2026-06-16

Description

Multiple vulnerabilities in SYMDNS.SYS for Symantec Norton Internet Security and Professional 2002 through 2004, Norton Personal Firewall 2002 through 2004, Norton AntiSpam 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 through 2.0 allow remote attackers to cause a denial of service or execute arbitrary code via (1) a manipulated length byte in the first-level decoding routine for NetBIOS Name Service (NBNS) that modifies an index variable and leads to a stack-based buffer overflow, (2) a heap-based corruption problem in an NBNS response that is missing certain RR fields, and (3) a stack-based buffer overflow in the DNS component via a Resource Record (RR) with a long canonical name (CNAME) field composed of many smaller components.

Affected products

Symantec Client Firewall: 5.01, 5.1.1
Symantec Client Security: 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+5)
Symantec Norton Antispam: 2004
Symantec Norton Internet Security: 2002, 2003, 2004
Symantec Norton Personal Firewall: 2002, 2003, 2004

References

Get alerted when CVE-2004-0444 or the next vulnerability affects your stack