{
  "port": 2967,
  "protocol": "tcp",
  "service": "Symantec AntiVirus / SSC agent",
  "oneLiner": "Legacy Symantec AntiVirus management agent — the port the \"Big Yellow\" worm hunted.",
  "whatItIs": "2967 is registered as ssc-agent and is the port Symantec AntiVirus Corporate Edition and Symantec Client Security used for management communication with rtvscan.exe, the real-time scanner service. In 2006 the Sagevo (\"Big Yellow\") worm scanned the internet for 2967 and installed a bot on unpatched clients by exploiting CVE-2006-2630, a stack-based buffer overflow in Symantec AntiVirus 10.1 and Client Security 3.1; Metasploit's module for it targets exactly this port. Scanning noise on 2967 has never fully died down, and it remains one of the more commonly probed non-obvious ports.",
  "exposure": {
    "verdict": "never",
    "note": "An endpoint-security management agent running with system privileges, with a wormed remote code execution in its history — internal management network only, on supported software."
  },
  "checkCommand": "nc -vz -w 3 TARGET 2967",
  "links": [
    {
      "title": "CVE-2006-2630 — Symantec AntiVirus / Client Security remote stack overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-2630",
      "kind": "official-docs"
    },
    {
      "title": "rapid7/metasploit-framework — symantec_rtvscan exploit module (port 2967)",
      "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/antivirus/symantec_rtvscan.rb",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 2967 (ssc-agent)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2967",
      "kind": "iana"
    }
  ],
  "ianaName": "ssc-agent"
}