Re: Symantec Virus Detection(Free ActiveX) - Remote Buffer Overflow, Apr 7 2004 2:22AM

[Sym Security <secure@xxxxxxxxxxxx>]

In Response to:


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application:    Symantec Virus Detection(Free ActiveX)
Vendors: 
http://security.symantec.com/sscv6/vc_scan.asp?langid=ie&venid=sym&plfid=23&pkj=WJDORSJRFSKLUKUMXCC&vc_scanstate=2

Platforms:        Windows
Bug:                 Buffer Overflow
Risk:                 High - Running Arbitary Code
Exploitation:    Remote with browser
Date:                1 Apr 2004
Author:             Rafel Ivgi, The-Insider
e-mail:              the_insider mail com
web:                 http://theinsider.deep-ice.com

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1) Introduction
2) Bugs
3) The Code

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


-------------------------------------snip-----------------------------------------------------------------------------




Symantec has closely reviewed our Symantec Security Check based on Rafel 
Ivgi's finding in the referenced posting.
We have confirmed there is no buffer overflow and no remote code execution 
issue in the Symantec Security Check application. 
However, Symantec engineers were able to recreate a very low risk process 
crash given a sufficently large quanity of data passed
to the function in question. 

Following this scenerio, a user who recently ran a virus/security scan 
using Symantec Security Check could possibly see their 
browser crash were they to visit a malicious web site that was able to 
successfully exploit that issue.  In no instance would the
attacker be able to execute any remote code on the user system nor would 
the attacker gain access to any unauthorized information 
on the user's system through an attack against  Symantec's  Security Check 
application.

Symantec takes the security and functionality of our products very 
seriously and we are addressing the process crash issue in
Symantec Security Check.  Symantec will work closely in cooperation with 
anyone who feels they have found an issue in a Symantec product.
Contact secure@xxxxxxxxxxxxx

Symantec Product Security Team
secure@xxxxxxxxxxxx
http://www.symantec.com/security