Symantec Norton AntiVirus AutoProtect Module Remote Denial Of Service Vulnerability

Bugtraq ID:	12923
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Mar 28 2005 12:00AM
Updated:	Mar 28 2005 12:00AM
Credit:	Discovery of this vulnerability is credited to JPCERT.
Vulnerable:	Symantec Norton SystemWorks 2004 Professional Edition Symantec Norton System Works 2005 Premier Symantec Norton Internet Security 2005 Symantec Norton Internet Security 2004 Professional Edition Symantec Norton AntiVirus 2005 Symantec Norton AntiVirus 2004
Not Vulnerable:

Symantec Norton AntiVirus AutoProtect Module Remote Denial Of Service Vulnerability

The Symantec Norton AntiVirus AutoProtect module is reported prone to a remote denial of service vulnerability. It is reported that the issue manifests when an unspecified type of file is scanned by AutoProtect, the scan results in the device driver module failing leading to a subsequent kernel crash.

Symantec Norton AntiVirus AutoProtect Module Remote Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Symantec Norton AntiVirus AutoProtect Module Remote Denial Of Service Vulnerability

Solution:
Symantec has released a product update to address this issue and another denial of service issue. This update may be downloaded and installed manually using Symantec LiveUpdate as follows:
1. Open any installed Symantec product.
2. Click on LiveUpdate in the toolbar.
3. Run LiveUpdate until all available Symantec product updates are downloaded and installed.

Symantec Norton AntiVirus AutoProtect Module Remote Denial Of Service Vulnerability

References:

• SYM05-006 - Denial of Service in Symantec Norton AntiVirus AutoProtect (Symantec)