<<< Date Index >>>     <<< Thread Index >>>

Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]




Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]

*vulnerable [...only tested on!]

Symantec Norton AntiVirus 2003 Professional Edition
Symantec Norton AntiVirus 2002

*not vulnerable
Mcafee 7*
Mcafee 8*

Risk Impact: Medium
Remote: yes

Description:
While having a virus scan [automatic/manual] of some specially crafted 
compressed files; NAV triggers a DoS using 100% CPU for a very long time. 
Morover, NAV is unable to stop the scan in middle, even if the user wishes to 
manually stop the virus scan. Then, in this situation the only alternate is to 
kill the process. 
--- [Proof of Concept] ---
Please download this file.

 http://www.geocities.com/visitbipin/av_bomb_3.zip         <---  For symantec.

 http://www.geocities.com/visitbipin/EXTRACTit1st.zip      <--- A bzip2 file, 
test it on other AV products, too.

The file contains, 'EICAR Test String' burried in 49647 directories. This is 
just a RAW 'proof of concept'. A few 100kb's of compressed file could be 
crafted in a way... NAV will take hours or MIGHT even days to complete the scan 
causing 100% cup use in email gateways for hours. The compressed archive must 
not necessarily be a '.zip' to trigger this attack.

PLEASE: ...test this issue with other AV / trojan scanners as they might also 
be vulnerable. 

-----------
Bipin Gautam
http://www.geocities.com/visitbipin/

Disclaimer: The information in the advisory is believed to be accurate at the 
time of printing based on currently available information. Use of the 
information constitutes acceptance for use in an AS IS condition. There are no 
warranties with regard to this information. Neither the author nor the 
publisher accepts any liability for any direct, indirect or consequential loss 
or damage arising from use of, or reliance on this information.