Critical: Less critical Impact: Privilege escalation Where: Local system Solution Status: Unpatched

Software: Norton Internet Security 2004, Norton Internet Security 2004 Professional, Symantec Norton AntiVirus 2004

Description: Daniel Milisic has reported a vulnerability in Symantec Norton AntiVirus / Norton Internet Security, which can be exploited by malicious, local users to disable the auto-protection.

The vulnerability is caused due to an error in the auto-protection functionality when dealing with certain visual basic scripts. This can be exploited by a unprivileged user to force the auto-protection to be disabled for the current session.

This can further be exploited to e.g. download and execute malicious files which normally would be caught by the antivirus program.

The vulnerability has been confirmed on Norton Internet Security 2004. Other versions may also be affected.

Solution: Grant only trusted users access to the system or use another product.