bugtraq - [SNS Advisory No.72] Symantec Norton AntiVirus 2004 ActiveX Control Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040521094225.EB38.SNSADV@lac.co.jp>
Date: Fri, 21 May 2004 09:43:50 +0900
From: snsadv@....co.jp (snsadv)
To: bugtraq@...urityfocus.com
Subject: [SNS Advisory No.72] Symantec Norton AntiVirus 2004 ActiveX Control Vulnerability


----------------------------------------------------------------------
SNS Advisory No.72
Symantec Norton AntiVirus 2004 ActiveX Control Vulnerability

Problem first discovered on: Tue, 30 Mar 2004
Published on: Fri, 21 May 2004
----------------------------------------------------------------------

Overview:
---------
  Symantec Norton AntiVirus 2004 are prone to a DoS vulnerability. 


Problem Description:
--------------------
  An ActiveX Control provided by Symantec Norton Antivirus 2004 contains 
  a remotely exploitable DoS condition.

  In order to trigger this vulnerability, malicious website administrators
  must induce Internet Explorer users to view a specially crafted web site,
  which will consequently consume a lot of system resources.

  >> Note <<
  This vulnerability can also be used to launch an executable remotely if
  the attacker has previous knowledge of its location.


Tested Versions:
----------------
  Norton AntiVirus 2004


Solution:
---------
  Update the products by using LiveUpdate.


Discovered by:
--------------
  Yuu Arai y.arai@....co.jp


Acknowledgements:
-----------------

  Thanks to:
  Mr. Mitsugu Okatani


Disclaimer: 
-----------
  The information contained in this advisory may be revised without prior 
  notice and is provided as it is. Users shall take their own risk when 
  taking any actions following reading this advisory. LAC Co., Ltd. shall 
  take no responsibility for any problems, loss or damage caused by, or by 
  the use of information provided here.

  This advisory can be found at the following URL: 
  Reference: http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/72_e.html


------------------------------------------------------------------
Secure Net Service(SNS) Security Advisory <snsadv@....co.jp>
Computer Security Laboratory, LAC  http://www.lac.co.jp/security/