Multiple Norman Products RAR/CAB File Scan Evasion Vulnerability

Bugtraq ID:	35357
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 08 2009 12:00AM
Updated:	Jun 22 2009 05:59PM
Credit:	Thierry Zoller
Vulnerable:	Norman Virus Control Plus 0 Norman Virus Control for OS/2 5.5 Norman Virus Control for OS/2 5.4 Norman Virus Control for OS/2 5.3 Norman Virus Control for OS/2 5.2 Norman Virus Control for OS/2 5.1 Norman Virus Control for OS/2 5.0 Norman Virus Control for MIMESweeper 5.5 Norman Virus Control for MIMESweeper 5.4 Norman Virus Control for MIMESweeper 5.3 Norman Virus Control for MIMESweeper 5.2 Norman Virus Control for MIMESweeper 5.1 Norman Virus Control for MIMESweeper 5.0 Norman Virus Control for Lotus Domino 5.5 Norman Virus Control for Lotus Domino 5.4 Norman Virus Control for Lotus Domino 5.3 Norman Virus Control for Lotus Domino 5.2 Norman Virus Control for Lotus Domino 5.1 Norman Virus Control for Lotus Domino 5.0 Norman Virus Control for Linux 5.5 Norman Virus Control for Linux 5.4 Norman Virus Control for Linux 5.3 Norman Virus Control for Linux 5.2 Norman Virus Control for Linux 5.1 Norman Virus Control for Linux 5.0 Norman Virus Control for IIS 5.5 Norman Virus Control for IIS 5.4 Norman Virus Control for IIS 5.3 Norman Virus Control for IIS 5.2 Norman Virus Control for IIS 5.1 Norman Virus Control for IIS 5.0 Norman Virus Control for Firewall-1 5.5 Norman Virus Control for Firewall-1 5.4 Norman Virus Control for Firewall-1 5.3 Norman Virus Control for Firewall-1 5.2 Norman Virus Control for Firewall-1 5.1 Norman Virus Control for Firewall-1 5.0 Norman Virus Control for Exchange 5.5 5.5 Norman Virus Control for Exchange 5.5 5.4 Norman Virus Control for Exchange 5.5 5.3 Norman Virus Control for Exchange 5.5 5.2 Norman Virus Control for Exchange 5.5 5.1 Norman Virus Control for Exchange 5.5 5.0 Norman Virus Control for Exchange 2000 5.5 Norman Virus Control for Exchange 2000 5.4 Norman Virus Control for Exchange 2000 5.3 Norman Virus Control for Exchange 2000 5.2 Norman Virus Control for Exchange 2000 5.1 Norman Virus Control for Exchange 2000 5.0 Norman Virus Control E-mail plugins 0 Norman Virus Control 5.81 Norman Virus Control 5.7 Norman Virus Control 5.5 Norman Virus Control 5.4 Norman Virus Control 5.3 Norman Virus Control 5.2 Norman Virus Control 5.1 Norman Virus Control 5.0 Norman Virus Control 5.90 Norman Virus Control 5.82 Norman Secuirty Suite 0 Norman Network Protection 0 Norman Internet Control 0 Norman Endpoint Protection 0
Not Vulnerable:

Multiple Norman Products RAR/CAB File Scan Evasion Vulnerability

Multiple Norman products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.

The following products are affected:

Norman Virus Control single user and corporate versions
Norman Internet Control
Norman Virus Control E-mail plugins
Norman Endpoint Protection
Norman Security Suite
Norman Network Protection

Multiple Norman Products RAR/CAB File Scan Evasion Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NOTE: The researcher who reported this issue has developed proofs of concept, but they are not publicly available.

Multiple Norman Products RAR/CAB File Scan Evasion Vulnerability

Solution:
These issues have been addressed in Norman's compression library (NCL) 5.99.07. Fixes were released on Norman's Internet update servers as an automatic update June 3, 2009.

Multiple Norman Products RAR/CAB File Scan Evasion Vulnerability

References:

• Norman generic evasion (RAR) (Thierry Zoller)
  
• ERRATA: [TZO-32-2009] Norman generic bypass (RAR) (Thierry Zoller )
  
• [TZO-32-2009] Norman generic bypass (RAR) (Thierry Zoller )
  
• Vulnerabilites in Norman's compression library (NCL) (Norman)