Norton Antivirus 2000 POProxy USER Vulnerability

Bugtraq ID:	877
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 17 1999 12:00AM
Updated:	Dec 17 1999 12:00AM
Credit:	Posted to Bugtraq on December 17, 1999 by <[email protected]>. Additional information posted to Bugtraq on december 20, 1999 by Matt Conover <[email protected]>.
Vulnerable:	Symantec Norton AntiVirus 2000 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:	Symantec Norton AntiVirus for Windows ME 2001 - Microsoft Windows ME Symantec Norton AntiVirus 2001 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 b - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 3.5.1 SP5 - Microsoft Windows NT 3.5.1 SP3 - Microsoft Windows NT 3.5.1 SP2 - Microsoft Windows NT 3.5.1 SP1 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 3.5

Norton Antivirus 2000 POProxy USER Vulnerability

Norton Anti-Virus 2000 is a widely used commercial anti-virus application. POProxy is its integral e-mail scanner, which is implemented by selecting 'e-mail protection'.

POProxy behaves as a proxy for a POP server, listening on port 110. When users request their email, the request is proxied through POProxy and all mail passing through it is scanned for viruses.

If an attacker sends a packet containing 269 or more characters then poproxy.exe will crash. It may be possible for attackers to execute arbitrary code.

Norton Antivirus 2000 POProxy USER Vulnerability

Denial Of Service:
telnet victimhost
[269+ characters]

Currently the SecurityFocus staff are not aware of any exploits for this issue that execute code on the target system. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Norton Antivirus 2000 POProxy USER Vulnerability

Solution:
Symantec has put up a website with information on using LiveUPDATE to download the update that will eliminate this vulnerability.


Symantec Norton AntiVirus 2000

• Symantec Norton Antivirus Update Information (website)
  http://service1.symantec.com/SUPPORT/nav.nsf/docid/1999122317000206&sr c=exp

Norton Antivirus 2000 POProxy USER Vulnerability

References:

• New LiveUpdate Patch Removes Alleged Security Hole Created by the Norton AntiVir (Symantec)
  
• Norton AntiVirus 2000 for Windows 95/98/2000/NT Product Info (Symantec)