How severe is CVE-2008-0313?

CVE-2008-0313 has a CVSS 2.0 base score of 6.8, rated medium severity.

Is CVE-2008-0313 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (89th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2008-0313?

CVE-2008-0313 primarily affects Symantec Norton 360. In total, 10 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2008-0313?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2008-0313 published?

CVE-2008-0313 was published on 2008-04-08 and last updated on 2026-06-16.

CVE-2008-0313

CVE-2008-0313 is a medium-severity vulnerability in Symantec Norton 360 with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 6.8)
EPSS exploit prediction: 4% (89th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Symantec Norton 360
Published: 2008-04-08
Last modified: 2026-06-16

Description

The ActiveDataInfo.LaunchProcess method in the SymAData.ActiveDataInfo.1 ActiveX control 2.7.0.1 in SYMADATA.DLL in multiple Symantec Norton products including Norton 360 1.0, AntiVirus 2006 through 2008, Internet Security 2006 through 2008, and System Works 2006 through 2008, does not properly determine the location of the AutoFix Tool, which allows remote attackers to execute arbitrary code via a remote (1) WebDAV or (2) SMB share.

Frequently asked questions

What is CVE-2008-0313?: The ActiveDataInfo.LaunchProcess method in the SymAData.ActiveDataInfo.1 ActiveX control 2.7.0.1 in SYMADATA.DLL in multiple Symantec Norton products including Norton 360 1.0, AntiVirus 2006 through 2008, Internet Security 2006 through 2008, and System Works 2006 through 2008, does not properly determine the location of the AutoFix Tool, which allows remote attackers to execute arbitrary code via a remote (1) WebDAV or (2) SMB share.
How severe is CVE-2008-0313?: CVE-2008-0313 has a CVSS 2.0 base score of 6.8, rated medium severity.
Is CVE-2008-0313 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (89th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2008-0313?: CVE-2008-0313 primarily affects Symantec Norton 360. In total, 10 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2008-0313?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2008-0313 published?: CVE-2008-0313 was published on 2008-04-08 and last updated on 2026-06-16.

References

Affected products (10)

cpe:2.3:a:symantec:norton_360:1.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:norton_antivirus:2006:*:*:*:*:*:*:*
cpe:2.3:a:symantec:norton_antivirus:2007:*:*:*:*:*:*:*
cpe:2.3:a:symantec:norton_antivirus:2008:*:*:*:*:*:*:*
cpe:2.3:a:symantec:norton_internet_security:2006:*:*:*:*:*:*:*
cpe:2.3:a:symantec:norton_internet_security:2007:*:*:*:*:*:*:*
cpe:2.3:a:symantec:norton_internet_security:2008:*:*:*:*:*:*:*
cpe:2.3:a:symantec:system_works:2006:*:*:*:*:*:*:*
cpe:2.3:a:symantec:system_works:2007:*:*:*:*:*:*:*
cpe:2.3:a:symantec:system_works:2008:*:*:*:*:*:*:*

More vulnerabilities in Symantec Norton 360

CVE-2016-3645 — Critical (CVSS 9.8): Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP);…
CVE-2010-0107 — Critical (CVSS 9.3): Buffer overflow in an ActiveX control (SYMLTCOM.dll) in Symantec N360 1.0 and 2.0; Norton Internet Security, AntiVirus,…
CVE-2008-0312 — Critical (CVSS 9.3): Stack-based buffer overflow in the AutoFix Support Tool ActiveX control 2.7.0.1 in SYMADATA.DLL in multiple Symantec…
CVE-2016-3646 — High (CVSS 8.4): The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server…
CVE-2016-3644 — High (CVSS 8.4): The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server…
CVE-2016-2207 — High (CVSS 8.4): The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server…

All CVEs affecting Symantec Norton 360 →