Various Vulnerabilities in Norton Anti-Virus 2002
++++++++++++++++++++++++++++++++++++
Scope
----------
Edvice recently tested NAV 2002's ability to detect viruses in incoming
e-mail messages. NAV 2002 includes an Email protection feature that
scans incoming and outgoing e-mails for viruses.
The Findings
-----------------
We encountered 4 vulnerabilities in NAV 2002 email protection feature.
One of the vulnerabilities affects the Auto-Protect mechanism as well.
The vulnerabilities allow bypassing NAV 2002 email protection.
Details:
----------
1) It is possible to bypass NAV 2002 Incoming Email Protection by
injecting a NULL character into the MIME message. If the NULL character
appears before the virus part, then NAV 2002 fails to detect the virus.
2) Embedding virus or malicious code in certain non-RFC compliant MIME
formats in some instances causes Norton AntiVirus 2002 to prematurely
terminate scanning, allowing infected e-mails to go undetected in the
initial incoming scanning process.
3) Two file types, .nch and .dbx, are excluded by default from Norton
AntiVirus 2002 scanning. An attacker can take a Word macro virus, rename
it with an .nch or a .dbx extension, and send it to a victim. If the
victim runs Norton AntiVirus 2002, these files would be excluded from
being scanned. Because Windows automatically recognizes Microsoft
Office files, double-clicking the file executes the infected document.
4) By providing Different file names in the Content-Type and
Content-Disposition fields it is possible to deceive Norton AntiVirus
2002 to exclude the file from being scanned. Oulook will determine the
file's name using the Content-Disposition filename field while Norton
Anti-Virus 2002 will look at the Content-Type name field and exclude the
file from being scanned. E.g.
Content-Type: application/msword;
name=\"Virus.nch\"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename=\"Virus.exe\"
Vendor Status
---------------------
Symantec's response can be found at:
http://securityresponse.symantec.com/
Edvice Security Services
supportat_private
http://www.edvicesecurity.com
This archive was generated by hypermail 2b30 : Thu Mar 07 2002 - 18:04:42 PST