# WHATPORT(2967)

## NAME

port 2967 — Symantec AntiVirus / SSC agent — Legacy Symantec AntiVirus management agent — the port the "Big Yellow" worm hunted.

Protocol: TCP  
IANA: ssc-agent

## DESCRIPTION

2967 is registered as ssc-agent and is the port Symantec AntiVirus Corporate Edition and Symantec Client Security used for management communication with rtvscan.exe, the real-time scanner service. In 2006 the Sagevo ("Big Yellow") worm scanned the internet for 2967 and installed a bot on unpatched clients by exploiting CVE-2006-2630, a stack-based buffer overflow in Symantec AntiVirus 10.1 and Client Security 3.1; Metasploit's module for it targets exactly this port. Scanning noise on 2967 has never fully died down, and it remains one of the more commonly probed non-obvious ports.

## EXPOSURE

**Do not expose.** An endpoint-security management agent running with system privileges, with a wormed remote code execution in its history — internal management network only, on supported software.

## CHECK

```sh
nc -vz -w 3 TARGET 2967
```

## SEE ALSO

- docs — [CVE-2006-2630 — Symantec AntiVirus / Client Security remote stack overflow](https://www.cve.org/CVERecord?id=CVE-2006-2630) (cve.org)
- source — [rapid7/metasploit-framework — symantec_rtvscan exploit module (port 2967)](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/antivirus/symantec_rtvscan.rb) (github.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 2967 (ssc-agent)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2967) (iana.org)

---

HTML: <https://whatport.net/2967/> · JSON: <https://whatport.net/2967.json> · full dataset: <https://whatport.net/ports.json>