Norton Download Manager DLL Loading

SYMSA1394
Last Updated January 17, 2017
Initial Publication Date January 17, 2017
Copy Article Title/URL
Feedback
Subscribe
  • Status: Closed
  • Severity: Medium
  • CVSS Base Score: 4.6

Symantec has released an update to address a DLL loading vulnerability detected in the Norton Download Manager for affected products

Norton Download Manager

CVE

Affected Version(s)

Remediation

CVE-2016-6592

Prior to 5.6

Upgrade to 5.6

 

CVE-2016-6592

Severity/CVSSv3:

Medium / 4.6 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

References:

Impact:

Securityfocus: BID 95444  / NVD: CVE-2016-6592

Code execution

Description:

The Norton Download Manager is a small executable stub initially downloaded when a user visits the Norton portal to download a trial or licensed version of Norton security products and Norton Family. The Norton Download Manager is susceptible to a potential DLL loading issue. Ultimately, this issue is caused by a failure of the Norton Download Manager to use an absolute path when loading required DLLs during process startup. This can cause the default DLL search logic to be followed when looking for a required DLL. This could allow unauthorized execution provided a specifically-crafted DLL can be successfully substituted for an authorized DLL in the Norton Download Manager search path (normally the user’s browser download folder). If successfully targeted, the specifically-formatted substitute DLL would execute with the privileges of the logged-on user. In currently supported operating systems, these privileges would be at the user level for the initial actions of the Norton Download Manager as it does not require or request elevated privileges to function.

 

A remote attack against the Norton Download Manager would need to leverage known methods of trust exploitations in an attempt to compromise an authorized user. Such attempts generally require enticing an authorized user to visit a malicious or compromised website for a drive-by download or to click on a malicious link in an HTTP email to download malicious content.

 

Norton Download Manager is not updated though Liveupdate. Customers first download Norton Download Manager during the initial install of a Norton security product and it is normally a run-once application to manage the download and install of the selected Norton product. There is some potential that users may need to run a previously downloaded version of Norton Download Manager in the following scenarios:

  • Norton Download Manager has not been run since it was initially downloaded from the Norton portal
  • Norton Download Manager failed to download the full product installer
  • The full product installer itself failed during installation

The upgrade solution for impacted customers is to:

  • Delete any previously downloaded version of Norton Download Manager, version 5.6 or earlier
  • Download the updated version of Norton Download Manager currently posted to the Norton portal that is associated with their Norton security product

Customers and users who want to download a trial version of a Norton security or Norton Family product can visit the Norton website. Once there, navigate to PRODUCT & SERVICES and select Free Trials.

Customers who want to download a licensed Norton security or Norton Family product can log into their Norton account and click on Download.

 

*Affected Norton Family Products

  • Norton Family
  • Norton AntiVirus
  • Norton AntiVirus Basic
  • Norton Internet Security
  • Norton 360
  • Norton 360 Premier
  • Norton Security
  • Norton Security with Backup
  • Norton Security Standard
  • Norton Security Deluxe
  • Norton Security Premium
  • Symantec Endpoint Protection Cloud

Best Practices

Symantec recommends the following measures to reduce the risk of attack:

  • Restrict access to administrative or management systems to authorized privileged users.
  • Restrict remote access to trusted/authorized systems only.
  • Users should have UAC enabled and never use a browser while running with elevated privileges to limit the impact of potential exploit attempts.
  • Keep all operating systems and applications current with vendor patches.
  • Follow a multi-layered approach to security. At a minimum, run both firewall and anti-malware applications to provide multiple points of detection and protection to both inbound and outbound threats.

 

  • Sachin M. Wagh, aka tiger_tigerboy (CVE-2016-6592)
  • Praveen Singh (CVE-2016-6592)
  • Takashi Yoshikawa, Mitsui Bussan Secure Directions working with JP CERT (CVE-2016-6592)
  • January 23, 2017: Updated acknowledgements for clarification
  • March 6, 2017: Cosmetic updates to advisory
Legacy ID: SYM17-001

Thanks for your feedback. Let us know if you have additional comments below. (requires login)

    © 1995-2019 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.