bugtraq - Re: Norton AntiVirus 2004/2005 Scripting Vulnerability Pt.3 (Includes PoC VBScript Code)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b7bc1b1f041104070016287dbf@mail.gmail.com>
Date: Thu, 4 Nov 2004 07:00:49 -0800
From: GuidoZ <uberguidoz@...il.com>
To: 3APA3A <3apa3a@...urity.nnov.ru>
Cc: Daniel Milisic <dmilisic@...ealbox.com>, full-disclosure@...ts.netsys.com,
   bugtraq@...urityfocus.com
Subject: Re: Norton AntiVirus 2004/2005 Scripting Vulnerability Pt.3 (Includes PoC VBScript Code)

While you're statement is entirely true, I believe what Daniel is
trying to point out is the fact that NAV's script blocking feature
(which is supposed to stop ALL attacks, known or not, if they involve
scripting) isn't working.

If you don't password protect your AV settings, a simple batch file
can disable many of them (NAV included) by mimicing their uninstall
routines. A VB script should be stopped by the built in script
blocking, making a more complicated script (as compared to a few-line
batch file) impossible to wreak havoc on your system, or to the AV
program itself.

Though I haven't tested Daniel's script itself, if what he states is
true, then there is certainly a problem with the script based
protection.

--
Peace. ~G

On Thu, 4 Nov 2004 16:57:11 +0300, 3APA3A <3apa3a@...urity.nnov.ru> wrote:
> Dear Daniel Milisic,
> 
> Antiviral  protection  is signature based. Any new virus can do anything
> with antiviral program, and there is no currently protection against it.
> It's by design.
> 
> --Thursday, November 4, 2004, 4:09:02 AM, you wrote to full-disclosure@...ts.netsys.com:
> 
> DM> Hi All,
> 
> DM> I have major issues with the quality of Norton AntiVirus.  For some
> DM> history, see:
> 
> --
> ~/ZARAZA
> Ñýð Èñààê Íüþòîí îòêðûë, ÷òî ÿáëîêè ïàäàþò íà çåìëþ. (Òâåí)
> 
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html