SAV9 Functionality Hole - misses virus files

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Symantec is aware and currently investigating this posting.

Symantec Product Security Team
Symantec takes the security of our products seriously and is a
responsible disclosure company. You can view our response policies
at http://www.symantec.com/security.
We will work directly with anyone who believes they have found a
security issue in a Symantec product to validate the problem and
coordinate any response deemed necessary.

Please contact secure@symantec.com concerning security issues with
Symantec products.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQjeppgLsezw0Sg5hEQIlAQCg8X03ejxsSS1I+JTnCbGoLY FjopcAoPbb
WTeQo/BMoo07/5rW5VFN9AKJ
=Ht37
-----END PGP SIGNATURE-----

SAV can be *configured* to behave like this.

I believe that such a configuration was a work-around to a bug in an older
version relating to word documents opening read-only across a network.

Could I just add my voice to those requesting more detailed documentation as
to how SAV actually works? Sometimes it really does feel like those of us on
Gold Support contracts are scratching around in the dark.

Nick Batchelor

-----Original Message-----
From: me3@neuralfibre.com [mailto:me3@neuralfibre.com]
Sent: 15 March 2005 06:27
To: bugtraq@securityfocus.com
Subject: SAV9 Functionality Hole - misses virus files



Product: Symantec AntiVirus Corporate Edition 9.0

Vulnerability: Files saved on the server but opened remotely via SMB are not
scanned.

SAV9 runs as a client - server application. The client receives updates, the
server pushes them out. This has no bearing on the platforms on which they
run, nor on scanning operation. The server could run on an NT4 workstation
and the clients on your 2003 servers.

When SAV9 is protecting the file server, and an unprotected client saves
files to a share on the server, the files are not scanned.
When another unprotected client opens these files, they are not scanned by
the server.
The server will only find these files during a scheduled scan.

Symantec documentation mentions file share scanning but makes no
differentiation between opening the file on the client or the server. The
documentation is misleading.
Technical support was advised and again recited the same misleading
statement.

Picture this
1. Consultant visits and saves infected file to server 2. Client with laptop
that didn't get latest update as was offline, comes in to work and opens
file off the "safe, prrotected" server - infected laptop.

This also means from a licencing standpoint, the only point of running SAV
on your file servers is to protect it when apps are run locally on that
server. If you don't run apps on your server, there is little point in
running SAV on it.

So much for defence in depth.

Testing Trend ServerProtect showed it instantly detected and deleted the
virus on save.

Other AV products still to be tested.

Other questions relate to files published / saved through other protcols
such as HTTP, SMB, Frontpage Server Extensions, TFTP, etc etc.

Conclusion
The API that Symantec is using is not on file open from the file system, but
rather file open by the local desktop - this allows files to be saved and
opened without being scanned.

Paul Young

In-Reply-To: <423728D4.2090504@krellinst.org>

Creating an MSI package for distribution

http://service1.symantec.com/SUPPORT/ent-security.nsf/529c2f9adcf33a1088256e22005026f1/d637ed0f601f9f8388256e7d006a79eb?OpenDocument&prod=Symantec%20AntiVirus%20Corporate%20Edition&ver=9.0&src=ent&pcode=sav_ce&dtype=corp&svy=&prev=&miniver=savce_9.0

Virus Definition Download Methods

http://service1.symantec.com/SUPPORT/ent-security.nsf/529c2f9adcf33a1088256e22005026f1/aaa3f26fccc7c6f688256c6200729a70?OpenDocument&prod=Symantec%20AntiVirus%20Corporate%20Edition&ver=9.0&src=ent&pcode=sav_ce&dtype=corp&svy=&prev=&miniver=savce_9.0

Ports used in SAV communication

http://service1.symantec.com/SUPPORT/ent-security.nsf/529c2f9adcf33a1088256e22005026f1/826b484479226da688256c38008276b4?OpenDocument&prod=Symantec%20AntiVirus%20Corporate%20Edition&ver=9.0&src=ent&pcode=sav_ce&dtype=corp&svy=&prev=&miniver=savce_9.0

Info on Network Audit Feature(Client Discovery)

http://service1.symantec.com/SUPPORT/ent-security.nsf/529c2f9adcf33a1088256e22005026f1/6251ec8043fdca0188256e8b00423729?OpenDocument&prod=Symantec%20AntiVirus%20Corporate%20Edition&ver=9.0&src=ent&pcode=sav_ce&dtype=corp&svy=&prev=&miniver=savce_9.0

In-Reply-To: <20050315062647.21534.qmail@www.securityfocus.com>


>Date: 15 Mar 2005 06:26:47 -0000
>Message-ID: <20050315062647.21534.qmail@www.securityfocus.com>
>Content-Type: text/plain
>Content-Disposition: inline
>Content-Transfer-Encoding: binary
>MIME-Version: 1.0
>X-Mailer: MIME-tools 5.411 (Entity 5.404)
>From: <me3@neuralfibre.com>
>To: bugtraq@securityfocus.com
>Subject: SAV9 Functionality Hole - misses virus files
>
>
>
>Product: Symantec AntiVirus Corporate Edition 9.0
>
>Vulnerability: Files saved on the server but opened remotely via SMB are not scanned.
>
>SAV9 runs as a client - server application. The client receives updates, the server pushes them out. This has no bearing on the platforms on which they run, nor on scanning operation. The server could run on an NT4 workstation and the clients on your 200
3 servers.
>
>When SAV9 is protecting the file server, and an unprotected client saves files to a share on the server, the files are not scanned.
>When another unprotected client opens these files, they are not scanned by the server.
>The server will only find these files during a scheduled scan.
>
>--------------snip-----------------
>Conclusion
>The API that Symantec is using is not on file open from the file system, but rather file open by the local desktop - this allows files to be saved and opened without being scanned.
>
>Paul Young
-------------------------------end

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Symantec Response

Symantec engineers throughly tested SAV9 in the configuration
reported by the poster scanning all share files and could find no
issues in any of our testing.

SAV 9 is NOT vulnerable to the issues identified by the poster.

Symantec contacted the poster and worked with him to review his
configuration and environment to determine why he is seeing what he
had reported.

Symantec and the poster determined there was a configuration issue in
the way the poster had his Real-Time Virus Scan options set. File
types were being excluded from the scan that gave the erroneous
impression that SAV9 was not scanning files that should have been
scanned. To the contrary, SAV9 was operating exactly as it was
configured to.
Symantec encourages all customers to confirm configuration settings
to ensure files are properly scanned.

Symantec Product Security Team

Symantec takes the security of our products seriously and adheres to
responsible disclosure. Our response policies can be viewed at
http://www.symantec.com/security.
Symantec will work closely with anyone who believes they have found a
security issue in a Symantec product to validate the problem and
coordinate any response deemed necessary.

Please contact secure@symantec.com concerning security issues with
Symantec products.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQA/AwUBQjtI5ALsezw0Sg5hEQLGWgCgslSf5Rd37MAp/YvTF+UQP6s9ZVYAoKHj
V/6DDzQwEnZxvgXoBb84X8DI
=KZCz
-----END PGP SIGNATURE-----