• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

OSX - Norton Antivirus Vulnerability Block issue

A client of our just installed an update from Apple's Update in OSX and restarted. Once they logged in the vulnerability block kicked off and blocked something on their computer which stopped all network traffic, emails, internet, access to shared drives both wireless and wired. 

Is there a work around for the vulnerability in Norton so that it doesn't do this, and how do I fix it so that when I turn it back on it doesn't start blocking all the users network traffic?

Thanks

Update:


I see from several threads that North VB doesn't play well with Mac's that have Filesharing enabled or that are accessing Windows networks. That it thinks its being port scanned from time to time. I wonder if this is what caused VB to behave the way it did and block off all network activity? Is there a work around other than disabling VB?

Replies

Kudos0

Re: OSX - Norton Antivirus Vulnerability Block issue

When a vulnerability is detected, we close the socket that was being used for the offending traffic, or simply block the packet for other kinds of traffic.  Depending on what that socket was being used for, that might turn of that service completely, which is normal but somewhat annoying.

Can you give the signature that was detected? That'll tell us how to proceed. The signature name cna be found in the logs, or in the Notification window by clicking on the "More Info" button.

Ryan McGann Technical Director Norton Business Unit, Symantec
Kudos0

Re: OSX - Norton Antivirus Vulnerability Block issue

Sorry for the delay here is the message:

Date: 2012-10-23 9:19:48 AM
Action: {blocked}
Direction: {inbound}
Severity: Medium (5/9)
Signature: Portscan
Protocol: TCP
Remote port: 0
Remote address: sv-sbs1.lh.local
172.16.17.2
Local address: 172.16.17.108
Local port: 0
Local host: 172.16.17.108

Also, from the "Learn More..." button:

Portscan
Severity: Medium
This attack could pose a moderate security threat. It does not require immediate action.

Description
This signature defends against attempts to scan your Mac for open ports. Some attackers repeatedly scan your network connection looking for weaknesses. However, such scan may also have legitimate uses.

Affected
All Mac OS X and Windows systems.

Response
If you see this alert followed by a loss of Internet connectivity, you should go to your Norton product and disable the Portscan signature.

Possible False Positives
Due to a characteristic of Mac OS 10.4, this alert may be triggered by normal Internet activity. In extreme cases, this signature may block your DNS (domain name server), resulting in the loss of Internet connectivity.

Please advise of a the fix!

Thanks

A.

Kudos0

Re: OSX - Norton Antivirus Vulnerability Block issue

Ping..

Still waiting for a repsonse from Symantec support on the resolution for this Macintosh / Windows Network issue with their product! 

Thanks

Andrew English

Senior Support Specialist

XBASE Technologies Corp.

Kudos0

Re: OSX - Norton Antivirus Vulnerability Block issue

Sorry, we were all on a bit of a break here. Is 172.16.17.2 the router of your network?  And is the issue repeatable or did it just happen once?

Ryan McGann Technical Director Norton Business Unit, Symantec
Kudos0

Re: OSX - Norton Antivirus Vulnerability Block issue

sv-sbs1 (172.16.17.2) is a Microsoft Small Business Server 2011. 

 

The scan is typical of these servers, your product needs to adjust to it and not freak out. Please advise. 

 

Thanks

 

 

 

Kudos0

Re: OSX - Norton Antivirus Vulnerability Block issue

Well portscan is a legimate attack. I can't say what the SMB machine is doing that triggers the Portscan signature but you can just to disable the Portscan signature. 

Ryan McGann Technical Director Norton Business Unit, Symantec
Kudos0

Re: OSX - Norton Antivirus Vulnerability Block issue

Please explain how I can disable it on Norton Antirvirus for Mac. Thanks.

Kudos0

Re: OSX - Norton Antivirus Vulnerability Block issue

Ping

Kudos0

Re: OSX - Norton Antivirus Vulnerability Block issue

Automatic Protection -> Vulnerablility Protection -> Portscan

Uncheck the enabled checkbox.

Ryan McGann Technical Director Norton Business Unit, Symantec

This thread is closed from further comment. Please visit the forum to start a new thread.