[35664] in bugtraq
RE: Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]
daemon@ATHENA.MIT.EDU (DaiTengu)
Sat Jul 10 18:43:13 2004
Message-Id: <200407101810.i6AIAJ9X016829@ms-smtp-02.rdc-kc.rr.com>
From: "DaiTengu" <daitengu@war-ensemble.com>
To: <bugtraq@securityfocus.com>
Date: Sat, 10 Jul 2004 13:10:24 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
In-Reply-To: <20040709004641.22227.qmail@www.securityfocus.com>
Bipin Gautam wrote:
> Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]
>
> *vulnerable [...only tested on!]
>
> Symantec Norton AntiVirus 2003 Professional Edition Symantec Norton
> AntiVirus 2002
>
> *not vulnerable
> Mcafee 7*
> Mcafee 8*
>
> Risk Impact: Medium
> Remote: yes
>
> Description:
> While having a virus scan [automatic/manual] of some specially
> crafted compressed files; NAV triggers a DoS using 100% CPU for a
> very long time. Morover, NAV is unable to stop the scan in middle,
> even if the user wishes to manually stop the virus scan. Then, in
> this situation the only alternate is to kill the process. --- [Proof
> of Concept] ---
> Please download this file.
>
> http://www.geocities.com/visitbipin/av_bomb_3.zip <--- For
> symantec.
>
> http://www.geocities.com/visitbipin/EXTRACTit1st.zip <--- A
> bzip2 file, test it on other AV products, too.
>
> The file contains, 'EICAR Test String' burried in 49647 directories.
> This is just a RAW 'proof of concept'. A few 100kb's of compressed
> file could be crafted in a way... NAV will take hours or MIGHT even
> days to complete the scan causing 100% cup use in email gateways for
> hours. The compressed archive must not necessarily be a '.zip' to
> trigger this attack.
>
Tested on Symantec Corporate 9.0 (338). Scaned the file in just under 10
seconds with no noticable CPU usage.
OS: Windows XP (SP2 RC2)
