[Full-Disclosure] Norton AntiVirus Scanner Remote Denial Of Service Vulnerability [Part: !!!]

From: bipin gautam (visitbipin_at_yahoo.com)
Date: 07/09/04

  • Next message: Berend-Jan Wever: "Re: [Full-Disclosure] Mozilla Security Advisory 2004-07-08"
    To: full-disclosure@lists.netsys.com
    Date: Thu, 8 Jul 2004 17:40:07 -0700 (PDT)
    
    

    Anti-Virus Scanner Remote Denial Of Service
    Vulnerability [Part: !!!]

    *vulnerable [...only tested on!]

    Symantec Norton AntiVirus 2003 Professional Edition
    Symantec Norton AntiVirus 2002

    *not vulnerable
    Mcafee 7*
    Mcafee 8*

    Risk Impact: Medium
    Remote: yes

    Description:
    While having a virus scan [automatic/manual] of some
    specially crafted compressed files; NAV triggers a DoS
    using 100% CPU for a very long time. Morover, NAV is
    unable to stop the scan in middle, even if the user
    wishes to manually stop the virus scan. Then, in this
    situation the only alternate is to kill the process.
    --- [Proof of Concept] ---
    Please download this file.

     http://www.geocities.com/visitbipin/av_bomb_3.zip
        <--- For symantec.

     http://www.geocities.com/visitbipin/EXTRACTit1st.zip
        <--- A bzip2 file, test it on other AV products,
    too.

    The file contains, 'EICAR Test String' burried in
    49647 directories. This is just a RAW 'proof of
    concept'. A few 100kb's of compressed file could be
    crafted in a way... NAV will take hours or MIGHT even
    days to complete the scan causing 100% cup use in
    email gateways for hours. The compressed archive must
    not necessarily be a '.zip' to trigger this attack.

    I've decided not to contact SYMANTEC in any of my
    advisories since their "security responce team" is too
    slow to responce any reported incidence. PLEASE:
    ...test this issue with other AV / trojan scanners as
    they might also be vulnerable.

    -----------
    Bipin Gautam
    http://www.geocities.com/visitbipin/

    Disclaimer: The information in the advisory is
    believed to be accurate at the time of printing based
    on currently available information. Use of the
    information constitutes acceptance for use in an AS IS
    condition. There are no warranties with regard to this
    information. Neither the author nor the publisher
    accepts any liability for any direct, indirect or
    consequential loss or damage arising from use of, or
    reliance on this information.

                    
    __________________________________
    Do you Yahoo!?
    Yahoo! Mail is new and improved - Check it out!
    http://promotions.yahoo.com/new_mail

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Berend-Jan Wever: "Re: [Full-Disclosure] Mozilla Security Advisory 2004-07-08"

    Relevant Pages