Re: ATTN: Users of NAV, NSW or NIS 2004

From: PA Bear (PABearMVP_at_gmail.com)
Date: 02/11/05 

Date: Thu, 10 Feb 2005 22:23:08 -0500

Many users let LiveUpdate run automatically. There have been instances in
the past where automatic LiveUpdate did not download all available updates.
Users of NAV/NSW/NIS 2004 are encouraged to run LiveUpdate manually and
repeatedly until they get the "No additional updates available" prompt. 

-- 
~Robear Dyer (PA Bear)
MS MVP-Windows (Shell, IE/OE) & Security
Greg Smith wrote:
> In <OwORZB#DFHA.2756@TK2MSFTNGP15.phx.gbl>, PA Bear wrote:
>
> > Symantec UPX Parsing Engine Heap Overflow
> > http://secunia.com/advisories/14179
> > http://www.sarc.com/avcenter/security/Content/2005.02.08.html
>
> Anyone that has live update and has done a full update since February
> 8th has received a patch.  The following is a portion of the Symantec
> article addressing this flaw.
>
> "Symantec Response
> Symantec confirmed the vulnerability ISS identified in the original
> DEC2EXE engine. The DEC2EXE engine is no longer required to parse
> compressed files. Prior to ISS contacting Symantec with this
> vulnerability, Symantec had already removed the DEC2EXE engine from
> the scan engine upgrades implemented in the majority of Symantec
> products.
>
> Symantec has NOT seen any active attempts against or organizations
> impacted by this issue. However, Symantec Security Response created
> Bloodhound.Exploit.26, a heuristic detection for attempts to exploit
> the DEC2EXE.dll heap overflow vulnerability. Virus definitions version
> 70209af (extended version 2/9/2004 rev. 32) or greater contain this
> heuristic and are available via Symantec LiveUpdate or Symantec's
> Intelligent Updater.
>
> Recommended Upgrades
> As a part of normal best practices, users should keep vendor-supplied
> patches for all application software and operating systems up-to-date.
> Symantec strongly recommends customers, if they are not already
> running a current non-vulnerable product version/build, upgrade to
> their appropriate product update immediately to protect against these
> types of threats.
>
> Symantec product engineers have developed and released updates or
> Maintenance Releases for all impacted product versions that were not
> already upgraded in the latest product build release. Updates and
> Maintenance Releases are available either through Symantec's
> LiveUpdate for those products that have LiveUpdate capability or from
> the Symantec Product Support site at http://www.symantec.com/techsupp.
> "
> http://www.sarc.com/avcenter/security/Content/2005.02.08.html
>
> The full list of products effected (and not effected) can be found at
> the above link.

Relevant Pages

  • RE: Norton Stopped connecting with XP-Pro
    ... >> Symantec Common Client Updates ... >> Symantec Security Response Submission Software Updates ... > Downloading catalog file, not available. ... > LiveUpdate could not retrieve the catalog file of available Symantec product ...
    (microsoft.public.windowsxp.general)
  • Norton Stopped connecting with XP-Pro
    ... My Norton live update will not connect no matter how many time Take it off ... The following Symantec products and components are installed on your ... > Symantec Security Response Submission Software Updates ... LiveUpdate could not retrieve the catalog file of available Symantec product ...
    (microsoft.public.windowsxp.general)
  • Re: ATTN: Users of NAV, NSW or NIS 2004
    ... The following is a portion of the Symantec ... The DEC2EXE engine is no longer required to parse ... Recommended Upgrades ... LiveUpdate for those products that have LiveUpdate capability or from ...
    (microsoft.public.security)
  • Re: SP2 Issue with NAV 2004 Live Update
    ... Liveupdate because it only affects a very few machines. ... LiveUpdate had an internal error while getting ... Your Symantec programs were not updated. ... > You should try getting updates at a later time. ...
    (microsoft.public.windowsxp.general)
  • [NT] Local Privileges Elevation via Symantec LiveUpdate
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Symantec Automatic LiveUpdate, a functionality included with many Symantec ... the non-privileged user could gain privileges to search and edit all ...
    (Securiteam)