Multiple Norman Antivirus Products OLE2 File Parser Scan Bypass Vulnerability

Bugtraq ID:	25020
Class:	Input Validation Error
CVE:	CVE-2007-3952
Remote:	Yes
Local:	No
Published:	Jul 23 2007 12:00AM
Updated:	May 07 2015 05:36PM
Credit:	Sergio Alvarez of n.runs AG is credited with discovering this issue.
Vulnerable:	Norman Virus Control 5.90
Not Vulnerable:	Norman Scanner Engine 5.91.2 + Norman Virus Control 5.90

Multiple Norman Antivirus Products OLE2 File Parser Scan Bypass Vulnerability

Multiple Norman Antivirus products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.

An attacker may exploit this issue by sending maliciously crafted OLE2 '.doc' files to victims.

Successful exploits will allow attackers to distribute files containing malicious code that will not be detected by the antivirus application.

Multiple Norman Antivirus Products OLE2 File Parser Scan Bypass Vulnerability

An attacker may exploit this issue by distributing maliciously crafted OLE2 '.doc' files.

Multiple Norman Antivirus Products OLE2 File Parser Scan Bypass Vulnerability

Solution:
The vendor has released scanning engine version 5.91.02 to address this issue. This updated scanning engine is available as a Norman Internet Update download. Please contact the vendor for information on obtaining the updates via their Internet Update service.

Multiple Norman Antivirus Products OLE2 File Parser Scan Bypass Vulnerability

References:

• Vendor Homepage (Norman )
  
• n.runs-SA-2007.022 - Norman Antivirus DOC parsing Detection Bypass Advisory ([email protected])