Norton uses read this! (your firewall may not be safe)

http://www.internetnews.com/dev-news/print.php/3353841


Computer security specialist Symantec Thursday moved swiftly to patch for four very serious vulnerabilities in its popular Norton firewall product suite.

An alert from Cupertino, Calif.-based Symantec described the flaws as "high risk" and warned that a successful exploit could wipe out a user's computer. Attackers could also execute remote code with kernel-level privileges on the targeted system.

The vulnerabilities, first discovered by researchers at eEye Digital Security, affect both enterprise and consumer Norton users. Affected products include the Symantec Client Firewall 5.01 and 5.1.1; the Symantec Client Security 1.0, 1.1, 2.0 (SCF 7.1); the Norton Internet Security and Professional 2002, 2003, 2004; Norton Personal Firewall 2002, 2003, 2004; and the Norton AntiSpam 2004.

Independent research firm Secunia rates the flaws as "extremely critical" because they could lead to a destructive worm attack. "The vulnerability is very similar to the 'ICQ Response Buffer Overflow' vulnerability in various ISS products, which was already exploited by the "Witty" worm the day after it was disclosed to the public," Secunia warned....

I've just looked over the site after posting this story, and there's not a mention of it anywhere on Symantec's site. Neither is it in the list when you manually bring up "Live Update".

Go figure. :confused:


http://www.symantec.com/index.htm

Source, Symantec.com: Symantec Client Firewall Remote Access and Denial of Service Issues

Quote:

---

SYM04-008
May 12, 2004
Symantec Client Firewall Remote Access and Denial of Service Issues

Revision History
None

Risk Impact
High

Overview
eEye Digital Security notified Symantec Corporation of four vulnerability issues they discovered in the Symantec Client Firewall products for Windows. By properly exploiting these issues, an attacker could render the targeted system inoperable or execute remote code with kernel-level privileges on the targeted system.

Affected Components
Consumer:
Symantec Norton Internet Security and Professional 2002, 2003, 2004
Symantec Norton Personal Firewall 2002, 2003, 2004
Symantec Norton AntiSpam 2004
Corporate:
Symantec Client Firewall 5.01, 5.1.1
Symantec Client Security 1.0, 1.1, 2.0(SCF 7.1)

[...continues...]

---

More like this: Symantec Security Response - Symantec Product Advisories

Hehe. I removed NIS 2 days ago & now have sygate pro. Must have felt it in my water.

Vernon, you'd think something like this would be smack dab on the front page. It still isn't, as of this moment.

How'd you find that? I looked all around and never saw it. Which is part of my point - why do we have to scour the bottom for critical info? Their web site has never been logically laid out.

Whatever the update was supposed to do, it appears to be causing more problems than it fixes. Probably pulled it, and hopefully they will now see the benefits in hiring a programmer.

For those still using NIS, my advice is to be sure you have a backup of the registry before doing any of Symantec's LiveUpdates. You will probably need it to at least stay operational, if not fully protected.

For those willing to give up the remaining licensing that you paid for, there are alternatives. As the problems within their recent updates have shown, Norton could use a real overhaul, not only in their software...

My 2 cents...

Problem: Symantec is less than forthcoming about their own security failures, and create pandemonium for their own users by making it virtually impossible to "uninstall" their own applications.

Solution: Don't give them any more of your money. Find a vendor you can trust.

Observation: AVG + OutPost

I use Norton System Works for years without any problems.

From what I hear and know I would not use their Firewall.

I think it is the program not the Company.

Just my 2 cents worth.

Take Care:)
https://discussions.virtualdr.com/

Personally, I think Symantec has lost sight of the original mission of the Norton series of utilities. The first version of the Norton Utilities I used fit on a 5.25" floppy and consisted of small, well-written utilities that ran in DOS and did things that made you wonder why Microsoft didn't include them in the first place.

Over time, their applications seemed more and more focused on bloat in the name of fast time-to-market rather than well thought-out and tested applications that work well with little disruption.

I've used various versions of NAV (DOS and Windows based) for some time now, and recently gave up on it and uninstalled it. It was using more resources than I was happy with, and the annual subscription fee was becoming insulting (yes, this is a gripe I've mentioned in many previous posts, but it still bugs me). I've still got SystemWorks for some of the utility it provides, but even the most recent version I installed had trouble initially and I had to plead with Symantec to send me a patch I knew existed only because of the newgroups on google. Plus, there's no excuse for an application to embed itself so deeply that it can't be uninstalled safely or properly. And how many problems have they had with LiveUpdate...?

Sorry for the rant, I know it's a little OT, but I'm disappointed with what I've seen of Symantec lately. From their past, I hold them to a higher standard than I would accept from other vendors, such as MS...

Anyways, just my $0.02...!

KV

Quote:

---

Originally posted by JoJo Gunn
Vernon, you'd think something like this would be smack dab on the front page. It still isn't, as of this moment.

How'd you find that? I looked all around and never saw it. Which is part of my point - why do we have to scour the bottom for critical info? Their web site has never been logically laid out.

---

1. Clicked "Security Response", (top of page, 4th button)
   
2. Clicked "View all security advisories [>go!] link, (on the right, under "security advisories" heading)
   
3. Clicked the "here" link, (in the "Advisories relating to Symantec products may be viewed here.") sentence.
   
4. Clicked the topmost "Symantec Client Firewall Remote Access and Denial of Service Issues" (May 12, 2004) link.

:)

And just how many licks to the center of a Tootsie Roll pop?

The world may never know....

:D

Hello, since the recent updates in Norton's Live Update, I now have an error 35 general protection fault in C:\Progr`1\Norton`1\
nauv.dx.ov1 or something similiar to that. Rather than try to troubleshoot it, I might just remove NAV from my computer.

I only have Norton Anti-Virus 2002. Perhaps those updates weren't for me, but I thought if Live Update offered it to my system that it was specific to my particular system. Would anyone know if those updates were intended for systems that only have Norton Anti-virus 2002? I run Win Dr. from Norton Utilities 2001 from the CD and it's not installed but I've seen references to it on my computer. So, maybe Live Update thought I had Norton Utilities installed, thus thought I needed the update.
Does anyone have any information regarding this? Regards, Ex-eastcoaster.

Ex-east......, it should work; I run NSW 2002 without any problems and get the Updates. As long as your subscription has not run out.
I hope this may help in some way?
Take care:)
https://discussions.virtualdr.com/

Hi Deltree. Is a general protection fault something that needs to be fixed or could one just leave it as is? I know it all depends on certain circumstances, but I was wondering, generally speaking, that is... Regards, Ex-eastcoaster.

Ex-east......., What OS are you running? and and how is your NAV working?What you might try is to uninstall it then reinstall it.
I hope this may help in some way?
Take Care:) https://discussions.virtualdr.com/

Deltree, thank you for your replies! Would you believe it, I no longer get the General Protection Fault message at the start of Windows! I downloaded & installed new NAV virus definitions today and after I did that, I quit getting that fault message. Maybe that was what fixed it or maybe it's because today was the second time I've run Live Update since the "Symantec Common Driver" update. I think I remember reading that you have to run Live Update once or twice after certain program updates, before a change is fully implemented. I'll go over my Norton material to find out about that. At any rate, no more "General Protection Fault" message! Regards, Ex-eastcoaster.

Don't know if my post is applicable to what has been said already, but here it is anyway.

For the past several days my computer has been very flaky and unstable and most times I could not open VDr and other sites. Mouse was sluggish and often would not move. On next reboot things "might" work OK.
I booted up this morning and everything was working very good. I decided to see if Nortons AV needed updating so I ran the LiveUpdate since the last update occurred on May 14, 04 as shown by Nortons.(I am now using a different hard disk drive and that is why AV was not updated to include the past 5 days) The update included several updates for 3-4 "parts" of AV and dated 5-19-04. Afterwards, I rebooted and then computer began the flaky business again--couldn't access sites; etc.
Being desperate, I uninstalled NIS2002 and then installed the free ETrust Firewall/AV and I am now able to surf and the mouse is totally responsive.
Am I finally having trouble with NIS2002 after using it for several years?? Did the AV update truly cause my problem or something else? Any answers/confirmations--anyone?? And as usual, TIA.
BTW, I really really hope that I was able to totally remove all of NIS2002 and the AV also. I used the Control Panel to remove it. I can always re-install it because I have the install disk.

buf: Here is the link on how to uninstall NIS 2002. There is a manual procedure listed, so you could check it to see if everything listed is now gone (I doubt if it is.)

http://service1.symantec.com/SUPPORT...rc=bar_sch_nam

I didn't look at it but if it involves editing the registry, be sure to do a registry backup before editing. That way, you can get back to where you are if something goes wrong...

HAN
Thanks for your link. I will check the info there and see what may still be on my computer and report back.
In the meantime, take a look at this link, one that I have just finished reading about:http://computercops.biz/postt41991....60755cb92d70610

EDIT: Having used Control Panel and uninstalled NIS, I don't know what else I can do to insure ALL of the NIS and NAV is or has been totally removed from my computer. I don't "do registry". I only know that doing what I reported having done already has enabled me to use my computer!!

an NIS update causes my 'puter to go to a BSOD, after a few minutes online. all virus scans,BOClean, and spybot are negtive.

the norton file doing it is SYMFW.SYS

when i send the 'error report' to microsoft,
their report back is that it is indeed SYMFW.SYS, from symantec. and to get the fix from them... but since NIS is no longer supported, we're very much out of luck... symantec/norton will not take email or phone calls re: ANY 2002 products.

i have disabled the firewall portion of NIS, continue to use NAV with zone alarm pro....and SINCE 5/16, no problems are occurring.

the file is a firewall filter driver : symfw.sys 5.3.1.53
RELEASED 4-29-04

EDIT: ZA pro is awsome. with just the default settings in place, the first check at SHIELDS UP was total stealth !

Buf:

What Norton doesn't want you to know, and they deeply bury it within the site, is that they have uninstallers for their uninstallers. No big surprise, though, is it, considering I started this thread a week ago and this critical firewall problem still isn't on their front page? :rolleyes:

I've uploaded a zip file with the uninstaller. Here's what products it'll work on (I've copied this from a log file within the folder):

PRODUCT(S)
Norton Internet Security 2000 1.0
Norton Personal Firewall 2000 2.0
Norton Internet Security 2000 2.0
Norton Internet Security Family Edition 2000 2.0
Norton Personal Firewall 2001 2.5
Norton Internet Security 2001 2.5
Norton Internet Security Family Edition 2001 2.5
Norton Personal Firewall 2001 3.0
Norton Internet Security 2001 3.0
Norton Internet Security Family Edition 2001 3.0
Norton Personal Firewall 2002 4.0
Norton Internet Security 2002 4.0
Norton Internet Security Professional 2002 4.5


For everyone else, absolutely do not try this unless it's listed here! I've read of problems with people getting the wrong uninstaller for their particular program.

By the way, Buf, I've also dumped Norton and am trying out this Etrust freebie that came with MS's "security" disc. It's different, takes a little getting used to the change, but it seems rock stable so far, and it's passed a couple of stealth tests.

Let's try this again. Apparently you can't upload a file and preview at the same time. It does say a zip file is a valid extension, no? :confused:

More about my computer troubles and my work around. I have two drives in it and on the Secondary drive I removed NIS and NAV by using the Control Panel and then installed the free ETrust AV that is on the disk that MS sent to those of us who indicated that we wanted the free MS offer of Critical Updates CD. Then I went to oldversions.com and downloaded and installed ZA version 2.6(thanks Train). Now that drive is fixed and working very well.
Today, I used the RnisUPG.EXE tool offered by Nortons and removed NIS on my Primary HDD. I used this tool even though we are told by Nortons NOT to use it UNLESS we are unable to remove NIS from the Control Panel etc. etc. etc. I knew about the tool but did NOT use it on the Secondary HDD because of the warning and I was able to remove NIS by using the Control Panel!! I have not found ANY remains of Nortons however, I do NOT "do" the registry and I assume the Rnis tool did it's job there using the Rnis tool on the Primary HDD.
This machine, the first one described in my signature, is percolating just fine now.
Hope I have covered everything for all to see and use if any are having any such problems.
Oh yeah, I also installed the ZA 2.6 to replace the NIS firewall!!!
BTW, NAV was not listed in the Control Panel on EITHER HDD; only NIS. Color me :D :D