NAI VirusScan Update Vulnerability
BID:169
Info
NAI VirusScan Update Vulnerability
| Bugtraq ID: | 169 |
| Class: | Unknown |
| CVE: |
CVE-1999-1195 |
| Remote: | No |
| Local: | Yes |
| Published: | May 05 1999 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | This vulnerability was discovered by Simple Nomad <[email protected]> and published in the NMRC "NAI AntiVirus Update Problem". |
| Vulnerable: |
Network Associates VirusScan for Windows NT 4.0.2 |
| Not Vulnerable: |
Network Associates VirusScan for Windows NT 4.0.3 a |
Discussion
NAI VirusScan Update Vulnerability
A vulnerability in Network Associates VirusScan for Windows NT stops it from updateting the virus signature definition files under certain conditions while it reports that it is up to date.
NAI's VirusScan features an option that allows the virus signature file to be updates automatically via FTP. A race condition in the code stops the program from correctly updating the definition file yet it fails to notice this error and updates the log as if the file was sucessufully updated and any subsequent updates will inform the user they are up to date. The error cannot be reproduced consistently.
To check that the file is being updated correctly go to the About box fromt he AntiVirus Console and read the latest date next to the text "Created On". If this date does not change after a manual or automatic update you are vulnerable.
A vulnerability in Network Associates VirusScan for Windows NT stops it from updateting the virus signature definition files under certain conditions while it reports that it is up to date.
NAI's VirusScan features an option that allows the virus signature file to be updates automatically via FTP. A race condition in the code stops the program from correctly updating the definition file yet it fails to notice this error and updates the log as if the file was sucessufully updated and any subsequent updates will inform the user they are up to date. The error cannot be reproduced consistently.
To check that the file is being updated correctly go to the About box fromt he AntiVirus Console and read the latest date next to the text "Created On". If this date does not change after a manual or automatic update you are vulnerable.
Exploit / POC
NAI VirusScan Update Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
NAI VirusScan Update Vulnerability
Solution:
Upgrade to VirusScan for Windows NT 4.0.3a or later.
Solution:
Upgrade to VirusScan for Windows NT 4.0.3a or later.
References
NAI VirusScan Update Vulnerability
References:
References: