发布时间 :2004-08-06 00:00:00
修订时间 :2017-07-10 21:30:22

[原文]Symantec Norton AntiVirus 2002 and 2003 allows remote attackers to cause a denial of service (CPU consumption) via a compressed archive that contains a large number of directories.

[CNNVD]Symantec Norton AntiVirus 2002 and 2003 服务拒绝漏洞(CNNVD-200408-120)

        Symantec Norton AntiVirus 2002 and 2003存在漏洞。远程攻击者可以通过含有大量目录的压缩文件导致服务拒绝(CPU消耗)。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)


- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(UNKNOWN)  BUGTRAQ  20040709 Norton AntiVirus Denial Of Service Vulnerability [Part: !!!]
(UNKNOWN)  XF  nav-compressed-dos(16658)

- 漏洞信息

Symantec Norton AntiVirus 2002 and 2003 服务拒绝漏洞
中危 未知
2004-08-06 00:00:00 2005-10-20 00:00:00
        Symantec Norton AntiVirus 2002 and 2003存在漏洞。远程攻击者可以通过含有大量目录的压缩文件导致服务拒绝(CPU消耗)。

- 公告与补丁


- 漏洞信息 (312)

Norton AntiVirus Denial of Service Vulnerability (EDBID:312)
windows dos
2004-07-12 Verified
0 Bipin Gautam
N/A [点击下载]
Norton AntiVirus Denial Of Service Vulnerability

*vulnerable [...only tested on!]

Symantec Norton AntiVirus 2003 Professional Edition
Symantec Norton AntiVirus 2002

*not vulnerable
Mcafee 7*
Mcafee 8*

Risk Impact: Medium
Remote: yes

While having a virus scan [automatic/manual] of some specially crafted compressed files; NAV triggers a DoS using 100% CPU for a very long time. Morover, NAV is unable to stop the scan in middle, even if the user wishes to manually stop the virus scan. 

Then, in this situation the only alternate is to kill the process. 

--- [Proof of Concept] ---
Please download this file. <--- For symantec. 

The file contains, 'EICAR Test String' burried in 49647 directories. This is just a RAW 'proof of concept'. A few 100kb's of compressed file could be crafted in a way... NAV will take hours or MIGHT even days to complete the scan causing 100% cup use in email gateways for hours. The compressed archive must not necessarily be a '.zip' to trigger this attack.

PLEASE: ...test this issue with other AV / trojan scanners as they might also be vulnerable. 

Bipin Gautam

Disclaimer: The information in the advisory is believed to be accurate at the time of printing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect or consequential loss or damage arising from use of, or reliance on this information. 

# [2004-07-12]

- 漏洞信息

Symantec Norton Anti-Virus Malformed Compressed Archive DoS
Denial of Service
Loss of Availability
Exploit Public

- 漏洞描述

Unknown or Incomplete

- 时间线

2004-07-09 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete