|
Symantec Norton SystemWorks Protected Recycle Bin Weakness
|
|
Secunia Advisory:
|
SA18402
|
|
|
Release Date:
|
2006-01-11
|
|
Last Update:
|
2006-08-04
|
|
Popularity:
|
13,071 views
|
|
|
Critical:
|
Not critical
|
|
Impact:
|
Security Bypass
|
|
Where:
|
Local system
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Symantec Norton SystemWorks 2005
Symantec Norton SystemWorks 2006
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-0166
|
|
Description:
A weakness has been reported in Norton SystemWorks, which can be exploited by malicious, local users, or by malware, to bypass certain security restrictions.
The weakness is caused due to a design error in SystemWorks in which files within the NProtect directory of the Norton Protected Recycle Bin are hidden from the "FindFirst/FindNext" Windows APIs. This prevents virus scanning software from detecting malicious or virus-infected files that are placed in the directory. On-access virus scanners reportedly are still able to detect the malicious files when they are accessed.
The weakness has been reported in the following versions.
* Norton SystemWorks 2005/2006
* Norton SystemWorks Premier 2005/2006
Solution:
Apply the patch by running LiveUpdate.
Provided and/or discovered by:
The vendor credits Mark Russinovich of Sysinternals and the F-Secure Blacklight team.
Changelog:
2006-08-04: Added CVE reference.
Original Advisory:
http://securityresponse.symantec.com/avcenter/security/Content/2006.01.10.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
