Sergio Alvarez has reported some vulnerabilities in Norman Antivirus products, which can be exploited by malware to bypass certain scanning functionality and by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

1) A boundary error when processing ACE archives can be exploited to cause a buffer overflow when e.g. scanning a specially crafted ACE archive.

2) Three boundary errors when processing LZH archives can be exploited to cause a buffer overflow when e.g. scanning a specially crafted LZH archive.

Successful exploitation of the vulnerabilities allow execution of arbitrary code.

3) A divide-by-zero error when processing DOC files can be exploited to to e.g. crash the application via a specially crafted DOC file.

4) An error within the processing of DOC files can be exploited to e.g. cause malware in a specially crafted DOC file to pass the scanning functionality undetected.

The vulnerabilities are reported in version 5.90 of the scanner engine. Other versions may also be affected.

Solution
Vulnerabilities #3 and #4 have reportedly been fixed in version 5.91.02 of the scanner engine.

Provided and/or discovered by
Sergio Alvarez, n.runs AG

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.nruns.com/security_advisory_Norman_all_ace_buffer_overflow.php
http://www.nruns.com/security_advisory_norman_antivirus_lzh_buffer_overflow.php
http://www.nruns.com/security_advisory_norton_antivirus_doc_divide_by_zero_dos.php
http://www.nruns.com/security_advisory_norman_antivirus_doc_depection_bypass.php

Deep Links
Links available to Secunia VIM customers