Symantec AntiVirus For Handhelds Auto-Protect Scanning Weakness

Bugtraq ID:	8639
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 17 2003 12:00AM
Updated:	Sep 17 2003 12:00AM
Credit:	Discovery is credited to <[email protected]>.
Vulnerable:	Symantec AntiVirus for Handhelds 3.0 .0.194
Not Vulnerable:

Symantec AntiVirus For Handhelds Auto-Protect Scanning Weakness

The Auto-Protect feature of Symantec AntiVirus for Handhelds reportedly fails to detect malicious code when it is loaded into memory, even if there are existing anti-virus definitions or heuristic detections. The discoverer of this weakness tested the issue with an 'eicar.exe' test file.

After further review, this BID will be retired. The Auto-Protect feature of Symantec AntiVirus for Handhelds is meant to detect malicious code in real time as it is being saved to the device. Since malicious code would first have to be saved to the device before it could be loaded into memory, this scenario could not occur.

Symantec AntiVirus For Handhelds Auto-Protect Scanning Weakness

There is no exploit required.

Symantec AntiVirus For Handhelds Auto-Protect Scanning Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Symantec AntiVirus For Handhelds Auto-Protect Scanning Weakness

References:

• Symantec AntiVirus for Handhelds Homepage (Symantec)
  
• Re: [Full-Disclosure] Exploiting Multiple Flaws in Symantec Antivirus 2004 for W (Sym Security )