This was going to be w00giving #11 (w00giving #10 will be posted within the next few days). Anyway, this allows EIP to be overwritten with 265+ bytes, which person who posted this vulnerability failed to mention or failed to notice. It's unclear if he labeled it as a DoS because he didn't realize it overwrote EIP or because he was unable to produce an exploit. We have not had a chance to write an exploit and we will also try to do that within the next few days. w00w00 Security Development Title: Buffer Overflow in POProxy (Norton Antivirus 2000) Platforms: Windows 95/98/NT/2000 Date: 11th December, 1999 Last Updated: n/a Vendor Notified: n/a Author: Nicholas Brawn <ncbat_private> 1. Background POProxy is the program used by Norton Antivirus to proxy POP3 mail collection, in order to identify hostile code (viruses, trojans, etc) before it reaches the system. By default Norton Antivirus' POP3 scanning supports Qualcomm Eudora and Microsoft Outlook mail clients. Other mail client software may be configured to use the "Email Protection" feature of Norton Antivirus. The POProxy program listens on all configured network interfaces on TCP port 110. 2. Description The POProxy program crashes (stack/EIP overwritten) when 265+ characters are sent as the parameter to the "USER" command. Note: When tested against POProxy on NT 4.0, this caused the Doctor Watson process to send CPU utilisation to 100%. 3. Impact The vulnerability may be exploited to execute arbitrary code on a vulnerable system. 4. Recommendation It is recommended that you disable "Email Protection" in Norton Antivirus, until a workaround or patch is made available by the vendor. To disable email protection go to: Start->Programs->Norton AntiVirus->Norton AntiVirus 2000 Click on "Options", and under Email Protection, uncheck to Enable Email Protection box. If disabling email protection is not an acceptable option, you may choose to implement a third-party firewalling product to disallow unauthorised connections to TCP port 110. Checkout http://www.networkice.com. 5. References - Norton Antivirus 2000: http://www.symantec.com/nav/nav_9xnt/ - w00w00 Security Development: http://www.w00w00.org/
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:21:56 PDT