bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Critical hole in Norton AntiVirus and Internet Security

Summary

In 2007 Symantec reported critical holes in Norton AntiVirus 2006, Norton Internet Security and SystemWorks through which a prepared website could take over a Windows PC. The cause was two ActiveX controls in NAVCOMUI.DLL that processed certain objects incorrectly. The updates were already being distributed via LiveUpdate, and the enterprise products were not affected.

Ideas

  • Security software brings its own components, which are themselves vulnerable.
  • An ActiveX control made the antivirus software reachable from the browser.
  • Automatic updates protected users before many of them learned of the hole.

Insights

  • Every additional piece of software, including protective software, enlarges the attack surface.
  • With widely used software, automatic updates are the most effective protection.

Facts

  • The faulty controls were called AxSysListView32 and AxSysListView32OAA.
  • Anyone who had disabled LiveUpdate had to trigger the update manually.

References

Critique

  • The bugs are only described as “not specified in detail”; independent analyses are missing.

Recommendations

  • Let security software update automatically and check that it actually does so.
  • Disable browser interfaces of desktop software that you do not need.

Read the original article

Search the Web Archive

hß · 2025

Google Chrome: critical security hole in web browser

In August 2025 Google closed a critical hole in Chrome (CVE-2025-9478), a use-after-free bug in the WebGL backend ANGLE. Attackers could exploit the memory bug via prepared websites, which usually leads to the execution of malicious code. The hole was fixed in Chrome 139.0.7258.154/155; Chromium-based browsers such as Edge are likely to be affected as well.

hß · 2024

Wednesday: Meta annoys AR developers, security hole at internet providers

Alongside Meta ending third-party AR effects and the Polaris Dawn launch, heise’s news round-up of 28 August 2024 reported an attack on internet providers. An unpatched hole in the network software Versa Director (CVE-2024-39717) was used to gain a foothold in at least four ISPs. There the attackers intercepted customer credentials in plain text before they were stored hashed; Lumen attributed the attack to the Chinese group Volt Typhoon.

hß · 2022

Takeover possible: DrayTek routers with critical security hole

In 2022 Trellix found a critical hole (CVE-2022-32548, CVSS 10.0) in numerous DrayTek routers through which unauthenticated attackers could take over the devices. A logic error in the length check on the login page /cgi-bin/wlogin.cgi led to a buffer overflow, exploitable from the LAN or via the internet if management was reachable there. The researchers found more than 200,000 vulnerable devices on the net.