mailing list archives
Norton Email Protection Remote Overflow (Addendum)
From: shok () CANNABIS DATAFORCE NET (Matt Conover)
Date: Mon, 20 Dec 1999 18:08:44 +0300
This was going to be w00giving #11 (w00giving #10 will be posted within
the next few days). Anyway, this allows EIP to be overwritten with 265+
bytes, which person who posted this vulnerability failed to mention or
failed to notice. It's unclear if he labeled it as a DoS because he
didn't realize it overwrote EIP or because he was unable to produce an
exploit. We have not had a chance to write an exploit and we will also
try to do that within the next few days.
w00w00 Security Development
Title: Buffer Overflow in POProxy (Norton Antivirus 2000)
Platforms: Windows 95/98/NT/2000
Date: 11th December, 1999
Last Updated: n/a
Vendor Notified: n/a
Author: Nicholas Brawn <ncb () attrition org>
POProxy is the program used by Norton Antivirus to proxy POP3 mail
collection, in order to identify hostile code (viruses, trojans, etc) before
it reaches the system.
By default Norton Antivirus' POP3 scanning supports Qualcomm Eudora and
Microsoft Outlook mail clients. Other mail client software may be configured
to use the "Email Protection" feature of Norton Antivirus.
The POProxy program listens on all configured network interfaces on TCP
The POProxy program crashes (stack/EIP overwritten) when 265+ characters
are sent as the parameter to the "USER" command.
Note: When tested against POProxy on NT 4.0, this caused the Doctor Watson process
to send CPU utilisation to 100%.
The vulnerability may be exploited to execute arbitrary code on a vulnerable
It is recommended that you disable "Email Protection" in Norton Antivirus,
until a workaround or patch is made available by the vendor.
To disable email protection go to:
Start->Programs->Norton AntiVirus->Norton AntiVirus 2000
Click on "Options", and under Email Protection, uncheck to Enable Email
If disabling email protection is not an acceptable option, you may choose to
implement a third-party firewalling product to disallow unauthorised
connections to TCP port 110. Checkout http://www.networkice.com.
- Norton Antivirus 2000: http://www.symantec.com/nav/nav_9xnt/
- w00w00 Security Development: http://www.w00w00.org/