Search:

April 2008

3588 - Symantec Norton Internet Security 2008 ActiveX Control Buffer Overflow Vulnerability and ActiveDataInfo.LaunchProcess Design Error Vulnerability

ID: 3588
Date: 07/04/2008

Title: 3588 - Symantec Norton Internet Security 2008 ActiveX Control Buffer Overflow Vulnerability and ActiveDataInfo.LaunchProcess Design Error Vulnerability
Platform level affected:Security Software
Hardware components affected:Intel PC
Specific operating systems components affected: 32-bit Windows
Net-enabled software: Other
Security software:AV/Content Scanning
Other software: Other
Remediation Summary:Update your copy of the software with the download available from the supplier.
Vendors affected:Symantec
Applications affected:Norton 360, Norton AntiVirus, Norton Internet Security , Norton System Works
Adversity source: Unknown
Attack Vector: Vulnerability exploitation
Virulence: Unknown
Warning Status: Active
Potential Damage: Remote execution/modification
Possible Duration: Open Ended
Availability of fix: Available
Type of fix: Patch
Source: Symantec
Reliability of source: Trusted
Source URL: www.symantec.com
CVE: CVE-2008-0312, CVE-2008-0313
Abstract: Remote exploitation of a buffer overflow vulnerability in an ActiveX control installed by Symantec Norton Internet Security 2008 could allow for the execution of arbitrary code

iDefense Security Advisory 04.02.08

http://labs.idefense.com/intelligence/vulnerabilities/

Apr 02, 2008

I. BACKGROUND

Norton Internet Security 2008 is a system security suite that offers protection from spyware, viruses, identity theft, spam, and malicious network traffic. More information can be found on the vendor's site at the following URL.

http://www.symantec.com/home_homeoffice/products/overview.jsp?pcid=is&pvid=nis2008

II. DESCRIPTION

Remote exploitation of a buffer overflow vulnerability in an ActiveX control installed by Symantec Norton Internet Security 2008 could allow for the execution of arbitrary code.

Norton Internet Security 2008 installs the following ActiveX control which is registered as safe for scripting:

Clsid: 3451DEDE-631F-421c-8127-FD793AFC6CC8

File: C:\PROGRA~1\COMMON~1\SYMANT~1\SUPPOR~1\SymAData.dll

Version 2.7.0.1

This control contains an exploitable stack based buffer overflow.

III. ANALYSIS

Exploitation allows attackers to execute arbitrary code with the privileges of the currently logged in user. In order for exploitation to occur, an attacker would have to lure a vulnerable user to a malicious web site.

While this control is marked as safe for scripting, the control has been designed so that it can only be run from the "symantec.com" domain. In practice this requirement can be bypassed through the use of any Cross Site Scripting (XSS) vulnerabilities in the Symantec domain.

Exploitation could also occur through the use of DNS poisoning attacks.

IV. DETECTION

iDefense confirmed that this vulnerability exists in version 2.7.0.1 of the control that is installed with the 2008 version of Norton Internet Security. Other versions may also be available.

V. WORKAROUND

Setting the kill-bit for this control will prevent it from being loaded within Internet Explorer. However, doing so will prevent legitimate use of the control.

VI. VENDOR RESPONSE

Symantec has addressed this vulnerability by releasing updates. For more information, refer to their advisory at the following URL.

http://www.symantec.com/avcenter/security/Content/2008.04.02a.html

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2008-0312 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.

VIII. DISCLOSURE TIMELINE

12/05/2007 Initial vendor notification

12/05/2007 Initial vendor response

04/02/2008 Coordinated public disclosure

IX. CREDIT

This vulnerability was reported to iDefense by Peter Vreugdenhil.

Get paid for vulnerability research

http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events http://labs.idefense.com/

X. LEGAL NOTICES

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition.

There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.

The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.

CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.