Symantec's Norton Anti-Virus Fails to Scan Files With Certain Characters in Path Names
|
|
SecurityTracker Alert ID: 1009333
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 5 2004
|
Impact: Denial of service via local system
|
Exploit Included: Yes
|
Version(s): 2002; version 8.00.58; possibly others
|
Description: A vulnerability was reported in Symantec's Norton Anti-Virus. A local user or a virus may create a file or directory that cannot be scanned by the anti-virus engine.
Bipin Gautam ( hUNT3R ) reported that the software will crash when performing a manual scan of a file or folder with a name containing
certain ASCII characters. The report indicates that ASCII characters 1 - 31 can be used in a folder or filename to trigger the
flaw. For example, a folder named '!' can be used. When Norton Anti-Virus attempts to scan the folder manually, 'NAVW32.exe' will
crash, the report said.
The Auto-Protect feature is not affected, the report said.
A demonstration exploit is available at:
http://www.geocities.com/visitbipin/t
est_nav.zip
|
Impact: A local user (or virus code) can create a file with a particular type of file path name that will not be scanned manually by the anti-virus scanning engine.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.symantec.com/ (Links to External Site)
|
Cause: State error
|
Underlying OS: Windows (Any)
|
Reported By: "Bipin Gautam." <door_hunt3r@blackcodemail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: 5 Mar 2004 18:35:33 -0000
From: "Bipin Gautam." <door_hunt3r@blackcodemail.com>
Subject: Norton Antivirus 2002 fails to scan files with special
|
Subject: Norton Antivirus 2002 fails to scan files with special character(s) properly.
Published: Friday, 05 March, 2004
Discovered By: Bipin Gautam ( hUNT3R )
Product Version: Norton Antivirus 2002 [ ver: 8.00.58 ] (~Only tested On...~)
Risk Impact: Low-Medium
* * *
Details:
During a 'manual scan' of a folder, if Norton Antivirus (NAV) encounters a file /folder name with 'so
me' ASCII characters ( 1-31)
NAV can't further proceed the manual scan and its front-end 'NAVW32.exe' crashes! This Bug has no im
pact in the NAV Auto-Protect
Engine.
Exploit: http://www.geocities.com/visitbipin/test_nav.zip
Create a folder (say: '!' ) and put some sub-folders and files in it. The file/sub-folder name must c
ontain ASCII character(s) (
1-31) . Have a manual scan of the folder named '!' NAV can't proceed the scan and crashes!
Disclaimer: The information in the advisory is believed to be accurate at the time of printing based
on currently available information.
Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties
with regard to this information.
Neither the author nor the publisher accepts any liability for any direct, indirect or consequential
loss or damage arising from
use of, or reliance on this information.
|
|
