Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

R: Norton AntiVirus Scanner Remote Denial Of Service Vulnerability [Part: !!!]
From: "Manuel -aka- ekerazha" <manuel () ekerazha com>
Date: Fri, 9 Jul 2004 11:43:38 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Kaspersky Anti-Virus Personal 5.0 *NOT* vulnerable ;)

- -----Messaggio originale-----
Da: bipin gautam [mailto:visitbipin () yahoo com]
Inviato: venerdì 9 luglio 2004 2.40
A: full-disclosure () lists netsys com
Oggetto: [Full-Disclosure] Norton AntiVirus Scanner Remote Denial Of Service
Vulnerability [Part: !!!]

Anti-Virus Scanner Remote Denial Of Service Vulnerability [Part: !!!]

*vulnerable [...only tested on!]

Symantec Norton AntiVirus 2003 Professional Edition Symantec Norton
AntiVirus 2002

*not vulnerable
Mcafee 7*
Mcafee 8*

Risk Impact: Medium
Remote: yes

Description:
While having a virus scan [automatic/manual] of some specially crafted
compressed files; NAV triggers a DoS using 100% CPU for a very long time.
Morover, NAV is unable to stop the scan in middle, even if the user wishes
to manually stop the virus scan. Then, in this situation the only alternate
is to kill the process.
- --- [Proof of Concept] ---
Please download this file.

 http://www.geocities.com/visitbipin/av_bomb_3.zip
    <---  For symantec.

 http://www.geocities.com/visitbipin/EXTRACTit1st.zip
    <--- A bzip2 file, test it on other AV products, too.

The file contains, 'EICAR Test String' burried in
49647 directories. This is just a RAW 'proof of concept'. A few 100kb's of
compressed file could be crafted in a way... NAV will take hours or MIGHT
even days to complete the scan causing 100% cup use in email gateways for
hours. The compressed archive must not necessarily be a '.zip' to trigger
this attack.

I've decided not to contact SYMANTEC in any of my advisories since their
"security responce team" is too slow to responce any reported incidence.
PLEASE:
...test this issue with other AV / trojan scanners as they might also be
vulnerable.

- -----------
Bipin Gautam
http://www.geocities.com/visitbipin/

Disclaimer: The information in the advisory is believed to be accurate at
the time of printing based on currently available information. Use of the
information constitutes acceptance for use in an AS IS condition. There are
no warranties with regard to this information. Neither the author nor the
publisher accepts any liability for any direct, indirect or consequential
loss or damage arising from use of, or reliance on this information.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (MingW32)

iD8DBQFA7mjOOfxxDDKav7ERAq23AJ4qpeQNfy5x2Jxf50rXqn4Osvwi3ACgs+iH
/FwBVulZNd8plz0PFlL05Wo=
=mbxR
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]