lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
From: uberguidoz at gmail.com (GuidoZ)
Subject: Norton AntiVirus 2004/2005 Scripting Vulnerability Pt.3 (Includes PoC VBScript Code)

While you're statement is entirely true, I believe what Daniel is
trying to point out is the fact that NAV's script blocking feature
(which is supposed to stop ALL attacks, known or not, if they involve
scripting) isn't working.

If you don't password protect your AV settings, a simple batch file
can disable many of them (NAV included) by mimicing their uninstall
routines. A VB script should be stopped by the built in script
blocking, making a more complicated script (as compared to a few-line
batch file) impossible to wreak havoc on your system, or to the AV
program itself.

Though I haven't tested Daniel's script itself, if what he states is
true, then there is certainly a problem with the script based
protection.

--
Peace. ~G


On Thu, 4 Nov 2004 16:57:11 +0300, 3APA3A <3apa3a@...urity.nnov.ru> wrote:
> Dear Daniel Milisic,
> 
> Antiviral  protection  is signature based. Any new virus can do anything
> with antiviral program, and there is no currently protection against it.
> It's by design.
> 
> --Thursday, November 4, 2004, 4:09:02 AM, you wrote to full-disclosure@...ts.netsys.com:
> 
> DM> Hi All,
> 
> DM> I have major issues with the quality of Norton AntiVirus.  For some
> DM> history, see:
> 
> --
> ~/ZARAZA
> ??? ????? ?????? ??????, ??? ?????? ?????? ?? ?????. (????)
> 
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>


Powered by blists - more mailing lists