Bugtraq mailing list archives
Re: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]
From: Tom Spencer <tom () mojohosting com>
Date: Fri, 09 Jul 2004 11:53:52 -0700
The same thing happens with classic mail bombs like 42.zip, NAV can't handle them.
Alan Parks Bipin Gautam wrote:
Norton AntiVirus Denial Of Service Vulnerability [Part: !!!] *vulnerable [...only tested on!] Symantec Norton AntiVirus 2003 Professional Edition Symantec Norton AntiVirus 2002 *not vulnerable Mcafee 7* Mcafee 8* Risk Impact: Medium Remote: yes Description:While having a virus scan [automatic/manual] of some specially crafted compressed files; NAV triggers a DoS using 100% CPU for a very long time. Morover, NAV is unable to stop the scan in middle, even if the user wishes to manually stop the virus scan. Then, in this situation the only alternate is to kill the process. --- [Proof of Concept] ---Please download this file. http://www.geocities.com/visitbipin/av_bomb_3.zip <--- For symantec. http://www.geocities.com/visitbipin/EXTRACTit1st.zip <--- A bzip2 file, test it on other AV products, too. The file contains, 'EICAR Test String' burried in 49647 directories. This is just a RAW 'proof of concept'. A few 100kb's of compressed file could be crafted in a way... NAV will take hours or MIGHT even days to complete the scan causing 100% cup use in email gateways for hours. The compressed archive must not necessarily be a '.zip' to trigger this attack.PLEASE: ...test this issue with other AV / trojan scanners as they might also be vulnerable.----------- Bipin Gautam http://www.geocities.com/visitbipin/ Disclaimer: The information in the advisory is believed to be accurate at the time of printing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect or consequential loss or damage arising from use of, or reliance on this information.
Current thread:
- Norton AntiVirus Denial Of Service Vulnerability [Part: !!!] Bipin Gautam (Jul 09)
- Re: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!] Tom Spencer (Jul 09)
- RE: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!] DaiTengu (Jul 10)
- <Possible follow-ups>
- RE: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!] Eric McCarty (Jul 09)
- Re: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!] Bipin Gautam (Jul 10)
- RE: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!] Sym Security (Jul 13)
- RE: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!] Sym Security (Jul 13)
- Re: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!] Bipin Gautam (Jul 17)