Sym Security
20/03/04, 18:15
In response to NGSSoftware Advisories NISR19042004a and NISR19042004b,=20
------------------------------------------------------------------
Symantec Security Advisory
SYM04-005
19 March, 2004=20
Symantec Norton Internet Security and Norton AntiSpam Remote Access=20
Vulnerability=20
Revision History
None
Risk Impact
High
Overview
NGSsoftware notified Symantec of a security vulnerability NGSsoftware had=20
found in the Symantec Norton Internet Security and Symantec Norton=20
AntiSpam 2004. If properly exploited this vulnerability could allow remote =
execution of arbitrary code on a targeted system resulting in possible=20
system compromise.
Affected Components
Symantec Norton Internet Security 2004 and Professional for Windows
Symantec Norton AntiSpam 2004=20
Details
Symantec was alerted to a remote access vulnerability that NGSsoftware=20
discovered while evaluating Symantec Norton Internet Security 2004 and=20
Symantec Norton AntiSpam 2004. Symantec Norton Internet Security and=20
Symantec Norton AntiSpam 2004 contain ActiveX components that do not do=20
proper bounds checking of external input. A malicious individual could=20
potentially exploit these weaknesses to launch a local application on the=20
target system and possibly run arbitrary code of their choice on the local =
system with elevated privileges.
To do this successfully, the attacker would need to either entice the=20
targeted user to visit a location where the malicious code could be=20
launched or to download and launch the malicious code on their system.=20
Successful execution of these security issues could result in compromise=20
of the targeted system.
Symantec Response
Symantec has verified the issues reported by NGSsoftware and released=20
patches for both Symantec Norton Internet Security and Symantec Norton=20
AntiSpam 2004 via Symantec LiveUpdate. Customers should run Symantec=20
LiveUpdate manually to ensure all installed Symantec products are fully=20
updated.
=B7 Open any installed Symantec product
=B7 Click on LiveUpdate in the toolbar
=B7 Run LiveUpdate until all available Symantec product updates are=20
downloaded and installed
Symantec is unaware of any active exploits for or customer impact from=20
these issues. Symantec will continue to evaluate the issues.
As a part of normal best practices, Symantec recommends using a=20
multi-layered approach to security. Users, at a minimum, should run both=20
personal firewall and antivirus applications with current updates to=20
provide multiple points of detection and protection to both inbound and=20
outbound threats.
Users should keep vendor-supplied patches for all application software and =
operating systems up-to-date.
Users should further be wary of mysterious attachments and executables=20
delivered via email and be wary of visiting unknown/untrusted websites.
Do not open attachments or executables from unknown sources. Always err on =
the side of caution.
Even if the sender is known, be wary of attachments if the sender does not =
fully explain the attachment content in the body of the email. You do not=20
know the source of the attachment.
If in doubt, contact the sender before opening the attachment. If still in =
doubt, delete the attachment without opening it.
CVE
Symantec has requested a Common Vulnerabilities and Exposures (CVE)=20
candidate name for these issues. We will revise this Advisory upon=20
receipt.
This is a candidate for inclusion in the CVE list (http://cve.mitre.org),=20
which standardizes names for security problems.
Credit:
Symantec appreciates the cooperation of Mark Litchfield and the=20
NGSsoftware research team in identifying this issue.
Symantec Product Security Contact:
Symantec takes the security and proper functionality of its products very=20
seriously. As founding members in the Organization for Internet Safety,=20
Symantec follows the process of responsible disclosure. Please contact=20
symsecurity@symantec.com if you feel you have discovered a potential or=20
actual security issue with a Symantec product.
Symantec strongly recommends using encrypted email for reporting=20
vulnerability information to symsecurity@symantec.com. The SymSecurity=20
PGP key may be obtained from the Symantec Security Response site.
---------------------------------------------------------------------------=
-----
Copyright (c) 2004 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as =
it is not edited in any way unless authorized by Symantec Security=20
Response. Reprinting the whole or parts of this alert in any medium other=20
than electronically requires permission from symsecurity@symantec.com.
Disclaimer
The information in the advisory is believed to be accurate at the time of=20
publishing based on currently available information. Use of the=20
information constitutes acceptance for use in an AS IS condition. There=20
are no warranties with regard to this information. Neither the author nor=20
the publisher accepts any liability for any direct, indirect, or=20
consequential loss or damage arising from use of, or reliance on, this=20
information.
Symantec, Symantec products, and SymSecurity are registered trademarks of=20
Symantec Corp. and/or affiliated companies in the United States and other=20
countries. All other registered and unregistered trademarks represented in =
this document are the sole property of their respective companies/owners.=20
------------------------------------------------------------------
Symantec Security Advisory
SYM04-005
19 March, 2004=20
Symantec Norton Internet Security and Norton AntiSpam Remote Access=20
Vulnerability=20
Revision History
None
Risk Impact
High
Overview
NGSsoftware notified Symantec of a security vulnerability NGSsoftware had=20
found in the Symantec Norton Internet Security and Symantec Norton=20
AntiSpam 2004. If properly exploited this vulnerability could allow remote =
execution of arbitrary code on a targeted system resulting in possible=20
system compromise.
Affected Components
Symantec Norton Internet Security 2004 and Professional for Windows
Symantec Norton AntiSpam 2004=20
Details
Symantec was alerted to a remote access vulnerability that NGSsoftware=20
discovered while evaluating Symantec Norton Internet Security 2004 and=20
Symantec Norton AntiSpam 2004. Symantec Norton Internet Security and=20
Symantec Norton AntiSpam 2004 contain ActiveX components that do not do=20
proper bounds checking of external input. A malicious individual could=20
potentially exploit these weaknesses to launch a local application on the=20
target system and possibly run arbitrary code of their choice on the local =
system with elevated privileges.
To do this successfully, the attacker would need to either entice the=20
targeted user to visit a location where the malicious code could be=20
launched or to download and launch the malicious code on their system.=20
Successful execution of these security issues could result in compromise=20
of the targeted system.
Symantec Response
Symantec has verified the issues reported by NGSsoftware and released=20
patches for both Symantec Norton Internet Security and Symantec Norton=20
AntiSpam 2004 via Symantec LiveUpdate. Customers should run Symantec=20
LiveUpdate manually to ensure all installed Symantec products are fully=20
updated.
=B7 Open any installed Symantec product
=B7 Click on LiveUpdate in the toolbar
=B7 Run LiveUpdate until all available Symantec product updates are=20
downloaded and installed
Symantec is unaware of any active exploits for or customer impact from=20
these issues. Symantec will continue to evaluate the issues.
As a part of normal best practices, Symantec recommends using a=20
multi-layered approach to security. Users, at a minimum, should run both=20
personal firewall and antivirus applications with current updates to=20
provide multiple points of detection and protection to both inbound and=20
outbound threats.
Users should keep vendor-supplied patches for all application software and =
operating systems up-to-date.
Users should further be wary of mysterious attachments and executables=20
delivered via email and be wary of visiting unknown/untrusted websites.
Do not open attachments or executables from unknown sources. Always err on =
the side of caution.
Even if the sender is known, be wary of attachments if the sender does not =
fully explain the attachment content in the body of the email. You do not=20
know the source of the attachment.
If in doubt, contact the sender before opening the attachment. If still in =
doubt, delete the attachment without opening it.
CVE
Symantec has requested a Common Vulnerabilities and Exposures (CVE)=20
candidate name for these issues. We will revise this Advisory upon=20
receipt.
This is a candidate for inclusion in the CVE list (http://cve.mitre.org),=20
which standardizes names for security problems.
Credit:
Symantec appreciates the cooperation of Mark Litchfield and the=20
NGSsoftware research team in identifying this issue.
Symantec Product Security Contact:
Symantec takes the security and proper functionality of its products very=20
seriously. As founding members in the Organization for Internet Safety,=20
Symantec follows the process of responsible disclosure. Please contact=20
symsecurity@symantec.com if you feel you have discovered a potential or=20
actual security issue with a Symantec product.
Symantec strongly recommends using encrypted email for reporting=20
vulnerability information to symsecurity@symantec.com. The SymSecurity=20
PGP key may be obtained from the Symantec Security Response site.
---------------------------------------------------------------------------=
-----
Copyright (c) 2004 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as =
it is not edited in any way unless authorized by Symantec Security=20
Response. Reprinting the whole or parts of this alert in any medium other=20
than electronically requires permission from symsecurity@symantec.com.
Disclaimer
The information in the advisory is believed to be accurate at the time of=20
publishing based on currently available information. Use of the=20
information constitutes acceptance for use in an AS IS condition. There=20
are no warranties with regard to this information. Neither the author nor=20
the publisher accepts any liability for any direct, indirect, or=20
consequential loss or damage arising from use of, or reliance on, this=20
information.
Symantec, Symantec products, and SymSecurity are registered trademarks of=20
Symantec Corp. and/or affiliated companies in the United States and other=20
countries. All other registered and unregistered trademarks represented in =
this document are the sole property of their respective companies/owners.=20