-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                  ESB-2009.0420 -- [Win][Netware][Linux]
           Symantec Log Viewer: Execute Arbitrary Code/Commands
                               30 April 2009

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Norton 360 Version 1.0
                      Norton Internet Security 2005 through 2008
                      Symantec AntiVirus 10.1 MR7 and earlier
                      Symantec Endpoint Protection 11.0 	
Publisher:            Symantec
Operating System:     Windows
                      Netware
                      Linux variants
Impact:               Execute Arbitrary Code/Commands
Access:               Existing Account

Original Bulletin:    
  http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_01

- --------------------------BEGIN INCLUDED TEXT--------------------

Symantec Log Viewer JavaScript Injection Vulnerabilities

SYM09-006

April 28, 2009

Description

Revision History
None

Risk Impact
Low
Remote Access	        No
Local Access	        Yes
Authentication Required	Yes
Exploit available	No

Overview
The Log Viewer feature in some Symantec products contains two parsing errors 
which could be exploited through Java script injection.

Affected Products
Product 	                Version 	        Solution
Norton 360 	                1.0 	                Run LiveUpdate in 
                                                        Interactive Mode
Norton Internet Security 	2005 through 2008 	Run LiveUpdate in 
                                                        Interactive Mode
Symantec AntiVirus 	        10.1 MR7 and earlier 	Update to 10.1 MR 8 
                                                        or later
Symantec Endpoint Protection 	11.0 	                Update to 11.0 MR1 
                                                        or later
Unaffected Products
Product 	                        Version
Norton 360 	                        2.0 and later
Norton Internet Security 	        2009 and later
Symantec AntiVirus Corporate Edition 	9.x (all), 10.2 (all)

Details
Next Generation Software notified Symantec that the Symantec Log Viewer 
(ccLgView.exe) feature used in Symantec products could be exploited through 
Javascript injection. Two parsing errors could potentially allow specially 
crafted email messages to pass a malicious script to the Symantec event log. 
These scripts could be loaded and executed if the user chooses the View Logs - 
Email Filtering' option from the Statistics option of the Symantec Log Viewer.

Symantec Response
Symantec verified that the vulnerabilities exist in the products listed in 
the Affected Products table above. Updates are available for all impacted 
products.

This vulnerability can be exploited only if the user views the Email 
filtering Log when it contains a malicious message.

Symantec is not aware of any customers impacted by these issues, or of any 
attempts to exploit them.

Updating Norton products
Symantec Norton product users who launch and run LiveUpdate regularly should 
already have received an update to address this issue. However, to ensure all 
available updates have been applied, users can manually launch and run 
LiveUpdate in Interactive mode as follows:

    * Open any installed Norton product
    * Click LiveUpdate
    * Run LiveUpdate until all available product updates are downloaded and 
      installed 

Best Practices
As a part of normal best practices, users should keep vendor-supplied patches 
for all software and operating systems up-to-date. Symantec recommends any 
affected customers update their product immediately to protect against 
potential attempts to exploit this vulnerability.

Additional best practices include:

    * Run under the principle of least privilege where possible. Information 
      on creating a limited user account is available on the Microsoft web 
      site.
    * Run both a personal firewall and antivirus application with current 
      updates to provide multiple points of detection.
    * Be cautious of unsolicited attachments and executables delivered via 
      email or via instant messaging.
    * Do not open email from unknown sources.
    * Do not follow links provided by unknown or untrusted sources.
    * Email addresses can easily be spoofed so a message appears to come from 
      someone you know. If a message seems suspicious, contact the sender 
      before opening attachments or following web links. 

Credit
Symantec thanks Mark Litchfield from Next Generation Security Software 
(http://www.ngssoftware.com/) for reporting this issue, and coordinating with 
us on the response.

References
This issue is a candidate for inclusion in the Common Vulnerabilities and 
Exposures (CVE) list (http://cve.mitre.org), which standardizes names for 
security problems. The CVE initiative has assigned Use CVE-2009-1428 to this 
issue

SecurityFocus, http://www.securityfocus.com, has assigned BID 34669 to this 
issue

Symantec takes the security and proper functionality of our products very 
seriously. As founding members of the Organization for Internet Safety 
(OISafety), Symantec supports and follows the principles of responsible 
disclosure. Symantec also subscribes to the vulnerability disclosure 
guidelines outlined by the National Infrastructure Advisory Council (NIAC).
Please contact secure@symantec.com if you feel you have discovered a security 
issue in a Symantec product. A Symantec Product Security team member will 
contact you regarding your submission. Symantec strongly recommends using 
encrypted email for reporting vulnerability information to secure@symantec.com. The Symantec Product Security PGP key can be found at the end of this message.
Symantec has developed a Product Vulnerability Response document outlining 
the process we follow in addressing suspected vulnerabilities in our products. 
This document is available below.

Symantec Vulnerability Response Policy:
http://www.symantec.com/security/Symantec-Product-Vulnerability-Response.pdf

Symantec Product Vulnerability Management PGP Key:
http://www.symantec.com/security/Symantec-Vulnerability-Management-Key.asc

Copyright (c)  by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as it 
is not edited in any way unless authorized by Symantec Security Response. 
Reprinting the whole or part of this alert in any medium other than 
electronically requires permission from secure@symantec.com

Disclaimer
The information in the advisory is believed to be accurate at the time of 
publishing based on currently available information. Use of the information 
constitutes acceptance for use in an AS IS condition. There are no warranties 
with regard to this information. Neither the author nor the publisher accepts 
any liability for any direct, indirect, or consequential loss or damage 
arising from use of, or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and 
secure@symantec.com are registered trademarks of Symantec Corp. and/or 
affiliated companies in the United States and other countries. All other 
registered and unregistered trademarks represented in this document are the 
sole property of their respective companies/owners.

Last modified on: April 28, 2009

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFJ+StnNVH5XJJInbgRArqLAJoCIBGH8CZd1h00CWJHwAIHXw9I7ACfdYz0
yCcukaLke2gjBFbptnM0cSA=
=Wt4/
-----END PGP SIGNATURE-----