NAV email protection bypass

Paul Wilders · Mar 8, 2002

7 March, 2002
Symantec Norton AntiVirus Email Protection Bypass

Reference
Edvice Security Services Ltd.

Risk Impact
Medium

Affected Components
Symantec Norton AntiVirus 2002

Overview
Edvice Security Services Ltd. notified Symantec that Symantec Norton AntiVirus 2002 incoming email scanning protection could be bypassed by the following means:

Embedding malicious code in a modified MIME message
The exclusion of .nch and .dbx extensions from scanning
MIME header with double file names

Details
Edvice Security Services Ltd. tested Symantec Norton AntiVirus 2002 and reported the following behaviors:

It is possible to bypass Norton AntiVirus 2002 Incoming Email Protection by injecting a NULL character into the MIME message. If the NULL character appears before the virus part, then Norton AntiVirus 2002 fails to detect the virus. Embedding virus or malicious code in specific non-RFC compliant MIME formats in some instances causes Norton AntiVirus 2002 to prematurely terminate scanning, allowing infected emails to go undetected in the initial incoming scanning process.
Embedding malicious code in certain non-RFC compliant MIME formats in some instances causes Norton AntiVirus 2002 to prematurely terminate scanning, allowing infected e-mails to go undetected in the initial incoming scanning process.
There are 2 file types, .nch and .dbx, which are excluded by default from Norton AntiVirus 2002 scanning. An attacker can take either a Word macro virus or an executable file with an embedded virus, rename it with an .nch or a .dbx extension, and send it to a victim. If the victim runs Norton AntiVirus 2002, these files would be excluded from being scanned. Because Windows automatically recognizes these files, double-clicking the file executes the infected document.
Renaming a .doc or .exe file with an "excluded" extension could deceive Norton AntiVirus 2002 to exclude the file from being scanned. For example,

Content-Type: application/msword;
name=\"Virus.nch\" or Virus.dbx

Content-Transfer-Encoding: base64

Content-Disposition: attachment;
filename=\"Virus.exe\"

In this example, the victim will receive an .exe file and not an .nch file. Microsoft Outlook determines the file name using the Content-Disposition field while Norton AntiVirus 2002 excludes the file after looking at the Content-Type field. Norton AntiVirus 2002 looks at the first "name" field while Outlook presents the filename as Virus.exe. An attacker can take a macro virus (for example, Virus.exe), rename it to Virus.nch, and send it to a potential victim. If the victim is using Norton AntiVirus 2002, the virus will not be detected by the email protection feature or by the Auto-Protect feature. However, double-clicking this file will cause it to execute.

Symantec Response
Symantec feels that there are some basic misunderstandings concerning the impact of Edvice Security's findings. Symantec Norton AntiVirus products provide multiple-layered scanning to protect in these cases. Symantec customers are not in danger of being infected through any of these issues.

Regarding the first two issues, Symantec has confirmed that although the initial incoming scan may be bypassed in the manner described by Edvice, the Symantec Norton AntiVirus AutoProtect feature protects a system by scanning active files for viruses, Trojan horses, and worms. If malicious code is hidden in such a manner as to bypass the initial email scan, the malicious virus or code would be detected in real time by a scheduled or manual scan if the file were saved on the targeted system. Additionally, attempts to execute the malicious code would cause Symantec Auto-Protect to alert. Finally, Symantec's Script Blocking feature would further prevent any malicious scripts from running on the targeted system. That said, Symantec takes the security of its products very seriously. Symantec will have an update to address this RFC issue available via LiveUpdate shortly.

In the third issue, newsgroups use .nch files for caching and local storage while the .dbx files are the mailbox files for Microsoft Outlook Express. It is true that by renaming the file type of a malicious file to one of the excluded file types, this will bypass the initial incoming email scan. Further, by renaming a Microsoft Office document containing malicious code or macros to one of the excluded extensions, Microsoft Office will still recognize the document as a Microsoft document and execute it on the system. However, when the malicious Microsoft document is executed the Norton AntiVirus Office plug-in would scan it and alert the user to any potential malicious activity. A renamed file or a type other than a Microsoft document would not execute on the computer and, therefore, could not infect a user's computer. Symantec is reviewing the exclusion feature to respond to this type of issue.

The fourth issue is similar to the third. By renaming a file containing malicious code to one with an excluded extension and delivering it in the non-RFC compliant MIME format, Norton Antivirus' incoming email scan could be bypassed and the malicious file saved on the system as a executable file or as a Microsoft Office document. However, if an attempt is made to execute the malicious file on the computer, the file will be detected by Norton AntiVirus or by the Norton AntiVirus Office plug-in, depending on the file type, which would alert the user to any potential malicious activity. Symantec will have an update to address this RFC issue available via LiveUpdate shortly.

Symantec recommends the following Best Practices to enhance the protection of your computers from unauthorized access:

Keep vendor-supplied patches for all software up-to-date
Be wary of mysterious attachments and executables delivered from email, user groups, and so on
Do not open attachments or executables from unknown sources. Always err on the side of caution
Even if the sender is known, be wary of attachments if the sender does not explain the attachment content in the body of the email. You do not know the source of the attachment
If in doubt, contact the sender before opening the attachment. If still in doubt, delete the attachment without opening it

Credit
Symantec takes the security and proper functionality of its products very seriously. Symantec appreciates the coordination of Mickey Boodaei and Edvice Security Services Ltd. in identifying and providing technical details of potential areas of concern so it can quickly address the issue. Anyone with information on security issues with Symantec products should contact symsecurity@symantec.com.
Click to expand...

source: Symantec

Log in or Sign up

NAV email protection bypass

Paul Wilders Administrator

Log in or Sign up

NAV email protection bypass

Paul Wilders Administrator

Useful Searches