n.runs-SA-2007.021 - Norman Antivirus LZH parsing Arbitrary Code Execution Advisory
n.runs AG
http://www.nruns.com/ security(at)nruns.com
n.runs-SA-2007.021 23-Jul-2007
________________________________________________________________________
Vendor: Norman, http://www.norman.com
Affected Products: All Norman Antivirus Solutions
Vulnerability: Arbitrary Code Execution (remote)
Risk: CRITICAL
________________________________________________________________________
Vendor communication:
2007/05/07 Initial notification to Norman together with our RFP
2007/05/08 Norman Responses asking for the PoC files
2007/05/08 Request public PGP keys
2007/05/08 PGP keys exchange
2007/05/08 PoC files sent to Norman
2007/05/08 Norman has PGP incompatible version problems
2007/05/08 Norman requests n.runs to send the PoC files RAR'ed
with password sent in in a separate mail
2007/05/08 Send the PoC files RAR'ed with password.
2007/05/08 Send the RAR'ed files password.
2007/05/08 Norman validates the vulnerabilities and informs that
the vulnerabilities will take long QA process because
the update for this vulnerabilities will need system
reboot.
2007/05/09 n.runs thanks for the feedback and asks for an
estimation of time to fix the vulnerabilities
2007/05/23 Ping Norman for a replay
2007/05/23 Norman replays that has forwarded the PoC files to
their engine/unpacker programmers, but hasn't
received any update as to how fast these can be fixed.
2007/05/23 n.runs thanks Norman for the feedback and reminds to
keep aligned with n.runs RFP (for the delay in the
replay)
2007/06/19 Ping to Norman for update on fix status and reminds
that the communication have to be aligned with
n.runs RFP
2007/06/19 Norman replays that can't decrypt the last mail (the
PING mail of the same date) and that has generated a
new DH/DSS key to use.
2007/06/19 Re-Send the Ping to Norman for status update
encrypted with the new Norman's key
2007/07/05 n.runs requests a replay to the ping In Clear Text
including the before mentioned PING mails as the
contents have no sensitive information.
2007/07/05 Norman replays and acknowledges that has received the
previous PING mail and adds the "Head of Engine
Development Team" in the loop.
2007/07/05 Norman's "Head of Engine Development Team" replays
that The OLE2 issues should be resolved with the
latest scanner engine (5.91.02) and that the
decompression issues, the crash cases will be
resolved soon, and he would expect an update to be
available within the next month
2007/07/05 n.runs thanks for the update information, also asks
how the credits are going to be handled and reminds
that the communication have to be aligned with
n.runs RFP
2007/07/10 Norman replays the following:
"Sergio,
We have discussed your mail. It is not our company's policy
to publish information about vulnerabilities or bugs in our
software, unless they are extremely critical and/or can be
worked around by the end-user. There are usually a large
number of vulnerabilities/bugs in any software, and in our
opinion it would only serve to unsettle user confidence in the
products if the industry continually feeds information about
such weaknesses, and we don't see that it would give the user
any benefit in return.
Instead we feel that it should be the supplier's
responsibility to correct any errors and weaknesses and have
them released to the user fast and silently, without alerting
also the malware industry.
Hence, there is no forum where we can credit you for your
findings.
We sincerely appreciate that you notify us whenever you find a
vulnerability in our software, as we appreciate such
information from other sources. These findings, in addition
to bug reports, are continuously being reviewed with respect
to seriousness and work involved in fixing the problems, and
assigned priorities accordingly, but no estimated dates for
fixing the issues are published.
This has always been - and presently is - our company's
policy. This policy may of course be revised by company
management at any time, if deemed necessary or useful."
2007/07/11 n.runs replays that when they request the PoC files
they implicitly accepted n.runs RFP and that the last
mail was violating n.runs RFP and request a soon
replay, otherwise the advisories would have to be
release uncoordinated.
2007/07/23 Norman DID NOT replay
2007/07/23 n.runs assumes that Norman finalized their
communication with n.runs
2007/07/23 Advisories release
________________________________________________________________________
Overview:
Norman ASA is a world leading company within the field of data security,
internet protection and analysis tools. Through its SandBox technology
Norman offers a unique and proactive protection unlike any other competitor.
While focusing on its proactive antivirus technology, the company has formed
alliances which enable Norman to offer a complete range of data security
services.
Norman was established in 1984 and is headquartered in Norway with
continental Europe, UK and US as its main markets.
Description:
Multiple remotely exploitable vulnerabilities have been found in the file
parsing engine.
In detail, the following flaw was determined:
- 3 (Three) Buffer Overflow through Integer Cast Around in .LZH file parsing
Impact:
These problems can lead to remote arbitrary code execution if an attacker
carefully crafts a file that exploits any of the aforementioned
vulnerabilities. The vulnerabilities are present in Norman Antivirus
software since at least version 5.90.
Solution:
These vulnerabilities were reported on May 07 and may remain UNFIXED to
the current date 23.Jul.2007.
________________________________________________________________________
Credit:
Bugs found by Sergio Alvarez of n.runs AG.
________________________________________________________________________
References:
This Advisory and Upcoming Advisories:
http://www.nruns.com/security_advisory.php
http://www.nruns.com/parsing-engines-advisories.php
________________________________________________________________________
Unaltered electronic reproduction of this advisory is permitted. For all
other reproduction or publication, in printing or otherwise, contact
security@xxxxxxxxx for permission. Use of the advisory constitutes
acceptance for use in an "as is" condition. All warranties are excluded.
In no event shall n.runs be liable for any damages whatsoever including
direct, indirect, incidental, consequential, loss of business profits or
special damages, even if n.runs has been advised of the possibility of
such damages.
Copyright 2007 n.runs AG. All rights reserved. Terms of apply.