Norton Antivirus Corporate Edition Configuration File Modification Vulnerability

Bugtraq ID:	6798
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 20 2001 12:00AM
Updated:	Nov 20 2001 12:00AM
Credit:	Discovery of this vulnerability credited to Micheal Espinola Jr [email protected].
Vulnerable:	Symantec Norton AntiVirus Corporate Edition 7.51
Not Vulnerable:

Norton Antivirus Corporate Edition Configuration File Modification Vulnerability

Norton Antivirus CE (NAVCE) stores its configuration file in a plain text format. This file is stored in a folder that has full write permissions for all users of the system.

An attacker within the required domain can exploit this vulnerability by connecting to the open NAVCE share and upload a maliciously constructed configuration file. Modifications of this file may result in client systems failing to obtain proper updates. Other attacks are also possible.

Norton Antivirus Corporate Edition Configuration File Modification Vulnerability

There is no exploit code required.

Norton Antivirus Corporate Edition Configuration File Modification Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Norton Antivirus Corporate Edition Configuration File Modification Vulnerability

References:

• Norton AntiVirus Corporate Edition Lets Local and Remote Users Change Anti-Virus (SecurityTracker)