Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2002-1777: Norton AntiVirus 2002 can miss malicious email attachments

CVE-2002-1777 · published 23 years ago

Summary

The 2002 version of Symantec Norton AntiVirus may fail to scan certain email attachments when the file name uses a special extension in the email header. This could let harmful files reach a user’s inbox, though the product’s later checks may still catch the virus before it runs. Updating the software or using additional email security controls is recommended.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
symantec	norton_antivirus	2002 `cpe:2.3:a:symantec:norton_antivirus:2002:::::::*`

Original advisory text

NOTE: this issue has been disputed by the vendor. Symantec Norton AntiVirus (NAV) 2002 allows remote attackers to bypass e-mail scanning via a filename in the Content-Type field with an excluded extension such as .nch or .dbx, but a malicious extension in the Content-Disposition field, which is used by Outlook to obtain the file name. NOTE: the vendor has disputed this issue, acknowledging that the initial scan is bypassed, but Norton AntiVirus or the Office plug-in would detect the virus before it is executed

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

3% chance of attack within 30 days

Timeline

Published31 Dec 2002

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2002-1777 · NVD

Track software like this

Free during beta