[virusinfo] Denial of Service vulnerability found in Norton Personal Firewall
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Fri, 23 Apr 2004 11:59:49 -0700
Denial of Service vulnerability found in Norton Personal Firewall
April 23, 2004
http://www.pcflank.com/news230404.htm
According to eEye Digital Security, a severe Denial of Service vulnerability
has been discovered in the Symantec Client Firewall products for Windows. By
exploiting this issue, an attacker could render the targeted system
inoperable.
The problem core is that by directing a series of specifically formatted TCP
packets to a target system running a vulnerable Symantec application, an
attacker can cause a complete system halt. As a result, the targeted system
would require a system reboot to clear the problem, which may cause serious
data loss or damage.
This vulnerability has been discovered in the following Symantec products:
Symantec Norton Internet Security and Professional 2003, 2004
Symantec Norton Personal Firewall 2003, 2004
Corporate:
Symantec Client Firewall 5.01, 5.1.1
Symantec Client Security 1.0 and 1.1
Because of the problem core and number of products affected this exploit has
been rated high, so the users are advised to apply patch immediately. These
patches are already released through Symantec LiveUpdate and technical
support channels.
Clients using retail versions of Symantec Norton Internet Security and
Symantec Norton Personal Firewall who regularly run Symantec LiveUpdate
should already be protected against this issue. However, to make sure the
protection is up-to-date, customers should run Symantec LiveUpdate manually
to ensure all available updates are installed.
Symantec also claims that no active attempts against or customer impact from
this issue.
From PC Flank www.pcflank.com
__________________________________________________
From Symantec
http://sarc.com/avcenter/security/Content/2004.04.20.html
SYM04-007
April 20, 2004
Symantec Client Firewall Denial of Service Vulnerability
Revision History
None
Risk Impact
High
Overview
eEye Digital Security notified Symantec Corporation of a severe Denial of
Service vulnerability they discovered in the Symantec Client Firewall
products for Windows. By properly exploiting this issue, an attacker could
render the targeted system inoperable.
Affected Components
Consumer:
Symantec Norton Internet Security and Professional 2003, 2004
Symantec Norton Personal Firewall 2003, 2004
Corporate:
Symantec Client Firewall 5.01, 5.1.1
Symantec Client Security 1.0 and 1.1
Details
eEye Digital Security notified Symantec of a Denial of Service vulnerability
they found during product testing against Symantec's client firewall
applications. By directing a specifically formatted TCP attack against a
target system running a vulnerable Symantec application, an attacker can
cause a complete system halt. As a result, the targeted system would require
a system reboot to clear the problem.
Symantec Response
Symantec confirmed the vulnerability reported by eEye Digital Security.
Symantec product engineers have developed fixes for the issue and released
patches for all impacted products through Symantec LiveUpdate and technical
support channels.
Clients using retail versions of Symantec Norton Internet Security and
Symantec Norton Personal Firewall who regularly run Symantec LiveUpdate
should already be protected against this issue. However, to be sure they are
fully protected, customers should run Symantec LiveUpdate manually to ensure
all available updates are installed.
Open any installed Symantec product
Click on LiveUpdate in the toolbar
Run LiveUpdate until Symantec LiveUpdate indicated that all installed
Symantec products are up-to-date
Clients running corporate versions of Symantec Client Firewall or Symantec
Client Security should download and apply patches obtained through their
appropriate support channels.
Symantec is not aware of any active attempts against or customer impact from
this issue.
CVE
The Common Vulnerabilities and Exposures (CVE) initiative has assigned
Candidate CAN-2004-0375 to this issue.
This is a candidate for inclusion in the CVE list (http://cve.mitre.org),
which standardizes names for security problems.
Credit
Symantec appreciates the cooperation of the eEye Digital Security research
team in identifying this issue.
Symantec Product Security Contact Information
Symantec takes the security and proper functionality of its products very
seriously. As founding members in the Organization for Internet Safety,
Symantec follows the process of responsible disclosure. Symantec also
subscribes to the vulnerability guidelines outlined by the National
Infrastructure Advisory Council (NIAC). Please contact secure@xxxxxxxxxxxx
if you feel you have discovered a potential or actual security issue with a
Symantec product.
Symantec strongly recommends using encrypted email for reporting
vulnerability information to secure@xxxxxxxxxxxxx The Symantec Product
Security PGP key can be obtained here.
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see ~ http://www.mwn.ca
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
See my Anti-Virus pages
<http://www3.telus.net/mikebike/mikes_virus_page.htm>
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance & OWTA Charter Member
Other related posts:
- » [virusinfo] Denial of Service vulnerability found in Norton Personal Firewall
