bugtraq - Norton Antivirus 2002 fails to scan files with special character(s) properly.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: 5 Mar 2004 18:35:33 -0000
From: Bipin Gautam. <door_hunt3r@...ckcodemail.com>
To: bugtraq@...urityfocus.com
Subject: Norton Antivirus 2002  fails to scan files with special
    character(s) properly.

Subject: Norton Antivirus 2002  fails to scan files with special character(s) properly.
Published: Friday, 05 March, 2004
Discovered By: Bipin Gautam ( hUNT3R )
Product Version: Norton Antivirus 2002 [ ver: 8.00.58 ] (~Only tested On...~)
Risk Impact: Low-Medium

*   *   *
Details: 

During a 'manual scan' of a folder, if Norton Antivirus (NAV) encounters a file /folder name with 'some'  ASCII characters ( 1-31) NAV can't further proceed the manual scan and its front-end 'NAVW32.exe' crashes! This Bug has no impact in the NAV Auto-Protect Engine.

Exploit: http://www.geocities.com/visitbipin/test_nav.zip
Create a folder (say: '!' ) and put some sub-folders and files in it. The file/sub-folder name must contain  ASCII character(s)  ( 1-31) . Have a manual scan of the folder named '!' NAV can't  proceed the scan and crashes!

Disclaimer: The information in the advisory is believed to be accurate at the time of printing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect or consequential loss or damage arising from use of, or reliance on this information.