n.runs AG http://www.nruns.com/ security(at)nruns.com n.runs-SA-2007.021 23-Jul-2007 ________________________________________________________________________ Vendor: Norman, http://www.norman.com Affected Products: All Norman Antivirus Solutions Vulnerability: Arbitrary Code Execution (remote) Risk: CRITICAL ________________________________________________________________________ Vendor communication: 2007/05/07 Initial notification to Norman together with our RFP 2007/05/08 Norman Responses asking for the PoC files 2007/05/08 Request public PGP keys 2007/05/08 PGP keys exchange 2007/05/08 PoC files sent to Norman 2007/05/08 Norman has PGP incompatible version problems 2007/05/08 Norman requests n.runs to send the PoC files RAR'ed with password sent in in a separate mail 2007/05/08 Send the PoC files RAR'ed with password. 2007/05/08 Send the RAR'ed files password. 2007/05/08 Norman validates the vulnerabilities and informs that the vulnerabilities will take long QA process because the update for this vulnerabilities will need system reboot. 2007/05/09 n.runs thanks for the feedback and asks for an estimation of time to fix the vulnerabilities 2007/05/23 Ping Norman for a replay 2007/05/23 Norman replays that has forwarded the PoC files to their engine/unpacker programmers, but hasn't received any update as to how fast these can be fixed. 2007/05/23 n.runs thanks Norman for the feedback and reminds to keep aligned with n.runs RFP (for the delay in the replay) 2007/06/19 Ping to Norman for update on fix status and reminds that the communication have to be aligned with n.runs RFP 2007/06/19 Norman replays that can't decrypt the last mail (the PING mail of the same date) and that has generated a new DH/DSS key to use. 2007/06/19 Re-Send the Ping to Norman for status update encrypted with the new Norman's key 2007/07/05 n.runs requests a replay to the ping In Clear Text including the before mentioned PING mails as the contents have no sensitive information. 2007/07/05 Norman replays and acknowledges that has received the previous PING mail and adds the "Head of Engine Development Team" in the loop. 2007/07/05 Norman's "Head of Engine Development Team" replays that The OLE2 issues should be resolved with the latest scanner engine (5.91.02) and that the decompression issues, the crash cases will be resolved soon, and he would expect an update to be available within the next month 2007/07/05 n.runs thanks for the update information, also asks how the credits are going to be handled and reminds that the communication have to be aligned with n.runs RFP 2007/07/10 Norman replays the following: "Sergio, We have discussed your mail. It is not our company's policy to publish information about vulnerabilities or bugs in our software, unless they are extremely critical and/or can be worked around by the end-user. There are usually a large number of vulnerabilities/bugs in any software, and in our opinion it would only serve to unsettle user confidence in the products if the industry continually feeds information about such weaknesses, and we don't see that it would give the user any benefit in return. Instead we feel that it should be the supplier's responsibility to correct any errors and weaknesses and have them released to the user fast and silently, without alerting also the malware industry. Hence, there is no forum where we can credit you for your findings. We sincerely appreciate that you notify us whenever you find a vulnerability in our software, as we appreciate such information from other sources. These findings, in addition to bug reports, are continuously being reviewed with respect to seriousness and work involved in fixing the problems, and assigned priorities accordingly, but no estimated dates for fixing the issues are published. This has always been - and presently is - our company's policy. This policy may of course be revised by company management at any time, if deemed necessary or useful." 2007/07/11 n.runs replays that when they request the PoC files they implicitly accepted n.runs RFP and that the last mail was violating n.runs RFP and request a soon replay, otherwise the advisories would have to be release uncoordinated. 2007/07/23 Norman DID NOT replay 2007/07/23 n.runs assumes that Norman finalized their communication with n.runs 2007/07/23 Advisories release ________________________________________________________________________ Overview: Norman ASA is a world leading company within the field of data security, internet protection and analysis tools. Through its SandBox technology Norman offers a unique and proactive protection unlike any other competitor. While focusing on its proactive antivirus technology, the company has formed alliances which enable Norman to offer a complete range of data security services. Norman was established in 1984 and is headquartered in Norway with continental Europe, UK and US as its main markets. Description: Multiple remotely exploitable vulnerabilities have been found in the file parsing engine. In detail, the following flaw was determined: - 3 (Three) Buffer Overflow through Integer Cast Around in .LZH file parsing Impact: These problems can lead to remote arbitrary code execution if an attacker carefully crafts a file that exploits any of the aforementioned vulnerabilities. The vulnerabilities are present in Norman Antivirus software since at least version 5.90. Solution: These vulnerabilities were reported on May 07 and may remain UNFIXED to the current date 23.Jul.2007. ________________________________________________________________________ Credit: Bugs found by Sergio Alvarez of n.runs AG. ________________________________________________________________________ References: This Advisory and Upcoming Advisories: http://www.nruns.com/security_advisory.php http://www.nruns.com/parsing-engines-advisories.php ________________________________________________________________________ Unaltered electronic reproduction of this advisory is permitted. For all other reproduction or publication, in printing or otherwise, contact security (at) nruns (dot) com [email concealed] for permission. Use of the advisory constitutes acceptance for use in an "as is" condition. All warranties are excluded. In no event shall n.runs be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if n.runs has been advised of the possibility of such damages. Copyright 2007 n.runs AG. All rights reserved. Terms of apply.