Onderwerp: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]

Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]

*vulnerable [...only tested on!]

Symantec Norton AntiVirus 2003 Professional Edition
Symantec Norton AntiVirus 2002

*not vulnerable
Mcafee 7*
Mcafee 8*

Risk Impact: Medium
Remote: yes

Description:
While having a virus scan [automatic/manual] of some specially crafted compressed files; NAV triggers a DoS using 100% CPU for a very long time. Morover, NAV is unable to stop the scan in middle, even if the user wishes to manually stop the virus scan. Th
en, in this situation the only alternate is to kill the process.
--- [Proof of Concept] ---
Please download this file.

http://www.geocities.com/visitbipin/av_bomb_3.zip <--- For symantec.

http://www.geocities.com/visitbipin/EXTRACTit1st.zip <--- A bzip2 file, test it on other AV products, too.

The file contains, 'EICAR Test String' burried in 49647 directories. This is just a RAW 'proof of concept'. A few 100kb's of compressed file could be crafted in a way... NAV will take hours or MIGHT even days to complete the scan causing 100% cup use in e
mail gateways for hours. The compressed archive must not necessarily be a '.zip' to trigger this attack.

PLEASE: ...test this issue with other AV / trojan scanners as they might also be vulnerable.

-----------
Bipin Gautam
http://www.geocities.com/visitbipin/

Disclaimer: The information in the advisory is believed to be accurate at the time of printing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to th
is information. Neither the author nor the publisher accepts any liability for any direct, indirect or consequential loss or damage arising from use of, or reliance on this information.

The same thing happens with classic mail bombs like 42.zip, NAV can't
handle them.

Alan Parks



Bipin Gautam wrote:

>
> Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]
>
> *vulnerable [...only tested on!]
>
> Symantec Norton AntiVirus 2003 Professional Edition
> Symantec Norton AntiVirus 2002
>
> *not vulnerable
> Mcafee 7*
> Mcafee 8*
>
> Risk Impact: Medium
> Remote: yes
>
> Description:
> While having a virus scan [automatic/manual] of some specially crafted compressed files; NAV triggers a DoS using 100% CPU for a very long time. Morover, NAV is unable to stop the scan in middle, even if the user wishes to manually stop the virus scan.
Then, in this situation the only alternate is to kill the process.
> --- [Proof of Concept] ---
> Please download this file.
>
> http://www.geocities.com/visitbipin/av_bomb_3.zip <--- For symantec.
>
> http://www.geocities.com/visitbipin/EXTRACTit1st.zip <--- A bzip2 file, test it on other AV products, too.
>
> The file contains, 'EICAR Test String' burried in 49647 directories. This is just a RAW 'proof of concept'. A few 100kb's of compressed file could be crafted in a way... NAV will take hours or MIGHT even days to complete the scan causing 100% cup use in
email gateways for hours. The compressed archive must not necessarily be a '.zip' to trigger this attack.
>
> PLEASE: ...test this issue with other AV / trojan scanners as they might also be vulnerable.
>
> -----------
> Bipin Gautam
> http://www.geocities.com/visitbipin/
>
> Disclaimer: The information in the advisory is believed to be accurate at the time of printing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to
this information. Neither the author nor the publisher accepts any liability for any direct, indirect or consequential loss or damage arising from use of, or reliance on this information.
>

Norton Antivirus 2004 Confirmed Vulnerable, Pegged CPU on a 3ghz machine =
for indefinate amount of time scanning.

Eric


-----Original Message-----
From: Bipin Gautam [mailto:visitbipin@hotmail.com]
Sent: Thursday, July 08, 2004 5:47 PM
To: bugtraq@securityfocus.com
Subject: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]




Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]



*vulnerable [...only tested on!]



Symantec Norton AntiVirus 2003 Professional Edition

Symantec Norton AntiVirus 2002



*not vulnerable

Mcafee 7*

Mcafee 8*



Risk Impact: Medium

Remote: yes



Description:

While having a virus scan [automatic/manual] of some specially crafted =
compressed files; NAV triggers a DoS using 100% CPU for a very long =
time. Morover, NAV is unable to stop the scan in middle, even if the =
user wishes to manually stop the virus scan. Then, in this situation the =
only alternate is to kill the process.=20

--- [Proof of Concept] ---

Please download this file.



http://www.geocities.com/visitbipin/av_bomb_3.zip <--- For =
symantec.



http://www.geocities.com/visitbipin/EXTRACTit1st.zip <--- A bzip2 =
file, test it on other AV products, too.



The file contains, 'EICAR Test String' burried in 49647 directories. =
This is just a RAW 'proof of concept'. A few 100kb's of compressed file =
could be crafted in a way... NAV will take hours or MIGHT even days to =
complete the scan causing 100% cup use in email gateways for hours. The =
compressed archive must not necessarily be a '.zip' to trigger this =
attack.



PLEASE: ...test this issue with other AV / trojan scanners as they might =
also be vulnerable.=20



-----------

Bipin Gautam

http://www.geocities.com/visitbipin/



Disclaimer: The information in the advisory is believed to be accurate =
at the time of printing based on currently available information. Use of =
the information constitutes acceptance for use in an AS IS condition. =
There are no warranties with regard to this information. Neither the =
author nor the publisher accepts any liability for any direct, indirect =
or consequential loss or damage arising from use of, or reliance on this =
information.

Bipin Gautam wrote:
> Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]
>
> *vulnerable [...only tested on!]
>
> Symantec Norton AntiVirus 2003 Professional Edition Symantec Norton
> AntiVirus 2002
>
> *not vulnerable
> Mcafee 7*
> Mcafee 8*
>
> Risk Impact: Medium
> Remote: yes
>
> Description:
> While having a virus scan [automatic/manual] of some specially
> crafted compressed files; NAV triggers a DoS using 100% CPU for a
> very long time. Morover, NAV is unable to stop the scan in middle,
> even if the user wishes to manually stop the virus scan. Then, in
> this situation the only alternate is to kill the process. --- [Proof
> of Concept] ---
> Please download this file.
>
> http://www.geocities.com/visitbipin/av_bomb_3.zip <--- For
> symantec.
>
> http://www.geocities.com/visitbipin/EXTRACTit1st.zip <--- A
> bzip2 file, test it on other AV products, too.
>
> The file contains, 'EICAR Test String' burried in 49647 directories.
> This is just a RAW 'proof of concept'. A few 100kb's of compressed
> file could be crafted in a way... NAV will take hours or MIGHT even
> days to complete the scan causing 100% cup use in email gateways for
> hours. The compressed archive must not necessarily be a '.zip' to
> trigger this attack.
>


Tested on Symantec Corporate 9.0 (338). Scaned the file in just under 10
seconds with no noticable CPU usage.

OS: Windows XP (SP2 RC2)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Symantec Product Security Team
Symantec takes the security of our products seriously and is a
responsible disclosure company. You can view our response policies
at http://www.symantec.com/security.
We will work directly with anyone who believes they have found a
security issue in a Symantec product to validate the problem and
coordinate any response deemed necessary.

Please contact secure@symantec.com concerning security issues with
Symantec products.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQA/AwUBQPQVHQLsezw0Sg5hEQKInQCfeo3ZBzQ1Lf212A03RN5NBS Jtlg0An3el
6oSD9+Yu6yapxKUQqCecrgI0
=fKh3
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Symantec is aware and currently investigating this issue.

- - ------------------------------------------------------------------
Symantec Product Security Team
Symantec takes the security of our products seriously and is a
responsible disclosure company. You can view our response policies
at http://www.symantec.com/security.
We will work directly with anyone who believes they have found a
security issue in a Symantec product to validate the problem and
coordinate any response deemed necessary.

Please contact secure@symantec.com concerning security issues with
Symantec products.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQA/AwUBQPRYmgLsezw0Sg5hEQKMXwCfXBaa1eTtyUwKGQvP/ntZoLoIzt0AoLk+
HFxGjSMoFD1pi21ZCnjkw3VG
=Et3m
-----END PGP SIGNATURE-----

In-Reply-To: <OF4FE03EE4.3D6B6CBB-ON88256ED0.00717712-87256ED0.0077C6E6@symantec.com>



there has been reports norton AntiVirus 2004 and norton AntiVirus 2005 (beta) is also prone to the exploit.

It's always hard to handle such tricks unless you specify a timeout value to scan a particular file. But, i doubt if this the right way to handle any file!

even if we impliment signatures for archive bombs, there are 10's of possibility to make..... again something different that the AV wont detect. )O;

bipin
>
>Symantec is aware and currently investigating this issue.
>
>- - ------------------------------------------------------------------
>Symantec Product Security Team
>Symantec takes the security of our products seriously and is a
>responsible disclosure company. You can view our response policies
>at http://www.symantec.com/security.
>We will work directly with anyone who believes they have found a
>security issue in a Symantec product to validate the problem and
>coordinate any response deemed necessary.
>
>Please contact secure@symantec.com concerning security issues with
>Symantec products.
>
>-----BEGIN PGP SIGNATURE-----
>Version: PGP 8.0.2
>
>iQA/AwUBQPRYmgLsezw0Sg5hEQKMXwCfXBaa1eTtyUwKGQvP/ntZoLoIzt0AoLk+
>HFxGjSMoFD1pi21ZCnjkw3VG
>=Et3m
>-----END PGP SIGNATURE-----
>