[NT] Symantec Norton Internet Security 2006 COM Object Security ByPass Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Symantec Norton Internet Security 2006 COM Object Security ByPass
Vulnerability
------------------------------------------------------------------------

SUMMARY

<http://www.symantec.com/home_homeoffice/products/overview.jsp?pcid=is&pvid=nis2006> Norton Internet Security 2006 is "a comprehensive system security suite that offers protection from spyware, viruses, identity theft, spam, and malicious network traffic". Remote exploitation of a design error vulnerability in an ActiveX control installed by Symantec Norton Internet Security 2006 could allow for the execution of arbitrary code.

DETAILS

Vulnerable Systems:
* Norton Internet Security 2006 version 12.2.0.13 of NavOpts.dll

Norton Internet Security 2006 installs the following ActiveX control which
is registered as safe for scripting:

Progid: Symantec.Norton.AntiVirus.NAVOptions
Clsid: 085ABFE2-D753-445C-8A2A-D4BD46CE0811
File: C:\Program Files\Norton Internet Security\Norton
AntiVirus\NAVOpts.dll
Version: 12.2.0.13

This control was designed for use in a application embedded web browser
rather than a native Internet Explorer window. When this control is loaded
in a standard browser window, it throws an error during initialization
which leaves the browser in a defunct state. After the error dialog
displays, other Symantec ActiveX Controls can be created without error
even if they are not marked as safe for scripting. This can lead to remote
code execution if the unsafe controls contain exploitable methods.

Analysis:
Exploitation allows malicious websites to load certain Symantec ActiveX
Controls which were not designed or secured for web use.

This condition can lead to the execution of arbitrary code in situations
where unsafe controls contain exploitable vulnerabilities.

Workaround:
Setting the kill-bit for the ActiveX control will prevent this component
from loading in Internet Explorer. Although this will prevent potential
exploitation, it may also negatively impact the functionality of the
application.

Vendor response:
Symantec has addressed this vulnerability with a software update. The
update is available via their LiveUpdate channels. For more information,
consult their advisory at the following URL:
<http://www.symantec.com/avcenter/security/Content/2007.05.09.html>

http://www.symantec.com/avcenter/security/Content/2007.05.09.html

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3456>
CVE-2006-3456

Disclosure timeline:
12/13/2006 - Initial vendor notification
12/13/2006 - Initial vendor response
05/09/2007 - Coordinated public disclosure

ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529>

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.