[NT] Norton Local Registry Protection Bypass (SuiteOwners)
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 28 Aug 2006 14:07:45 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Norton Local Registry Protection Bypass (SuiteOwners)
------------------------------------------------------------------------
SUMMARY
Norton applications protect their own registry keys against actions by
other applications.
The protection can be bypassed for the SuiteOwners key, allowing to load
malicious DLLs.
DETAILS
Vulnerable Systems:
* Norton Personal Firewall 2006 version 9.1.0.33
* Other versions of Norton Personal Firewall 2006 and Norton Internet
Security 2006 suspected.
Norton protects its own registry keys against actions of other
applications. This protection can be bypassed for registry key
'HKLM\SOFTWARE\Symantec\CCPD\SuiteOwners' using API functions RegSaveKey
and RegRestoreKey. This registry key is also used to store some important
information such us names of libraries, for example 'NISProd.dll'. Using
RegSaveKey and RegRestoreKey a malicious application can modify values in
'SuiteOwners' such that Norton loads fake library into its own processes.
A malicious code in the fake library can manipulate any Norton component
and thus bypass every security protection of Norton.
Disclosure Timeline:
* 2006-08-21: Candidate for inclusion in the CVE list
* 2006-08-21: Vulnerability confirmed by popular information sources
* 2006-08-15: Advisory released
* 2006-08-15: Vendor notification
ADDITIONAL INFORMATION
The original article can be found at:
<http://www.matousec.com/info/advisories/Norton-DLL-faking-via-SuiteOwners-protection-bypass.php> http://www.matousec.com/info/advisories/Norton-DLL-faking-via-SuiteOwners-protection-bypass.php
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NEWS] Mozilla Firefox Crash
- Next by Date: [EXPL] MDaemon USER Pre-Authentication Heap Overflow (Exploit)
- Previous by thread: [NEWS] Mozilla Firefox Crash
- Next by thread: [EXPL] MDaemon USER Pre-Authentication Heap Overflow (Exploit)
- Index(es):
Relevant Pages
|
|
