Secunia

Kurt Seifried has reported a weakness in Symantec Norton AntiVirus, which can be exploited by malware to bypass certain scanning functionality.

The problem is caused due to an error within the handling of files and directories on the system with reserved MS-DOS device names and can be exploited by including malware in a file or directory with such a name (e.g. "prn" or "aux").

Successful exploitation causes malware to evade detection during automatic and manual scans.

NOTE: Malware will reportedly still be detected by the email scanning functionality and upon execution.

Solution
The vendor has issued a fix for Symantec Norton AntiVirus 2004, which is available via LiveUpdate.
Further details available in Customer Area

Provided and/or discovered by
Kurt Seifried

Original Advisory
Symantec:
http://www.sarc.com/avcenter/security/Content/2004.10.05.html

iDEFENSE:
http://www.idefense.com/application/poi/display?id=147&type=vulnerabilities

Deep Links
Links available in Customer Area