Symantec Norton Antivirus LiveUpdate DoS Vulnerability

Bugtraq ID:	3413
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2001-1126
Remote:	Yes
Local:	No
Published:	Oct 05 2001 12:00AM
Updated:	Jul 11 2009 09:06AM
Credit:	Discovered by FX <[email protected]>, DasIch <[email protected]> and kim0 <[email protected]> and published in a Symantec Security Response on Oct 5, 2001.
Vulnerable:	Symantec LiveUpdate 1.6 + Symantec Norton AntiVirus 2001 0 + Symantec Norton AntiVirus 2002 0 + Symantec Norton AntiVirus Corporate Edition 7.51 + Symantec Norton AntiVirus Corporate Edition 7.5
Not Vulnerable:

Symantec Norton Antivirus LiveUpdate DoS Vulnerability

Symantec's Norton Antivirus contains a feature called LiveUpdate. LiveUpdate is a process that checks for new virus definitions over the internet, downloads and installs them from a Symantec site. This process can either be scheduled or performed manually.

It is possible for a remote user to cause LiveUpdate to redirect a download from a site of his/her choice. Therefore, a remote host could send an unusually large file as the update, potentially causing a denial of services on the target system.

Symantec Norton Antivirus LiveUpdate DoS Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Symantec Norton Antivirus LiveUpdate DoS Vulnerability

Solution:
Symantec has acknowledged this vulnerability, and is currently working on a solution.

Symantec Norton Antivirus LiveUpdate DoS Vulnerability

References:

• Phenoelit Advisory (Phenoelit Group)
  
• Symantec LiveUpdate 1.4 through 1.6 vulnerability (Symantec)