[Kitetoa, les pizzaïolos du Ouèb

w00giving 99 -12-

 
Sommaire de ce dossier
Ze advisories
Ze linkz
 

Norton Antivirus' POProxy

w00w00 Security Development (WSD)

--------------------------------------------------------------------------
Discovered by: Nicholas Brawn  ( ncb@attrition.org )

POProxy is the program used by Norton Antivirus to proxy POP3 mail
collection, in order to identify hostile code (viruses, trojans, etc)
before it reaches the system. The POProxy program listens on all
configured network interfaces on TCP port 110.

The POProxy program crashes (stack/instruction pointer overwritten) when
265+ characters are sent as the parameter to the "USER" command. This
affects Win 95/98/NT/2000 and allows a remote user to execute arbitrary
code.

Note: when tested against POProxy on NT 4.0, this caused the Doctor Watson
process to send CPU utilisation to %100.

--------------------------------------------------------------------------
Exploit:

None at this time.

--------------------------------------------------------------------------
Patch:

Until Norton AV releases an official patch, we provide the following work
around:

It is recommended that you disable "Email Protection" in Norton Antivirus,
until a workaround or patch is made available by the vendor.

To disable email protection go to:
Start ->Programs ->Norton AntiVirus  ->Norton AntiVirus 2000
(or whatever it's installed on)

Click on "Options", and under Email Protection, uncheck to Enable Email
Protection box.

If disabling email protection is not an acceptable option, you may choose to
implement a third-party firewalling product to disallow unauthorized
connections to TCP port 110. Checkout
http://www.networkice.com

--------------------------------------------------------------------------
Contributors to w00giving: eEye Digital Security and Underground Security
Systems Research (USSR)

w00friends:

http://www.attrition.org
http://www.eEye.com
http://www.ussrback.com

Page d'accueil

Nous écrire
By mail

Nous envoyer des commentaires
By la page de le Feed-Back

Les mailing-lists

Nouveautés

Les stats du serveur

et...

Qui sommes-nous?

Le Sommaire
de
Kitetoa
(orientation...)

Sommaire général du site
(voir tout le contenu)

Les rubriques!

Les livres publiés par Kitetoa
Les Textes
Les interviews

Kit'Investisseurs
Fonds d'écran et autres trucs

Les rubriques!
(suite)
Les Let-R-s

Des Images
On s'en fout!

KitEcout'
KessTaVu? -KiteToile
Voyages

Statisticator, l'autre site...

Les dossiers :

Precision [ZataZ]
Le monde fou des Admins
Defcon
Le hack le plus bizarre
Guerre de l'info
Convention contre la cyber-criminalité
Hack

Questionnaire visant à améliorer le contenu de  ce site si c'est possible et pas trop compliqué

Réponses au questionnaire visant...
(merci)

Le Forum
Kitetoa-blah-blah

Rechercher
sur le site

...et sur le Net


Des liens
et
D'autres choses du Ouèb