Symantec Firewalls DNS response packets denial of service
| symantec-firewall-dns-dos (16132) |  Medium Risk |
Description:
Symantec Norton Internet Security and Personal Firewall devices are vulnerable to a denial of service attack, caused by the improper validation of Domain Name System (DNS) response packets by the SYMDNS.SYS driver. By sending a specially-crafted DNS response packet from UDP port 53 that contains a compressed name pointer that points to itself, a remote attacker could cause the routine that processes the compressed name pointers to enter an infinite loop. The device must be rebooted to regain normal functionality.
Consequences:
Denial of Service
Remedy:
A patch is available for this vulnerability through Symantec LiveUpdate, as listed in Symantec Security Response SYM04-008. See References.
References:
- Full-Disclosure Mailing List, Wed May 12 2004 - 18:59:47 CDT: EEYE: Symantec Multiple Firewall DNS Response Denial-of-Service.
- Symantec Security Response SYM04-008: Symantec Client Firewall Remote Access and Denial of Service Issues.
- BID-10336: Symantec Client Firewall Remote DNS Response Denial Of Service Vulnerability
- CVE-2004-0445: The SYMDNS.SYS driver in Symantec Norton Internet Security and Professional 2002 through 2004, Norton Personal Firewall 2002 through 2004, Norton AntiSpam 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 through 2.0 allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a DNS response with a compressed name pointer that points to itself.
- OSVDB ID: 6100: Symantec Multiple Firewall DNS Response DoS
- SA11066: Symantec Client Firewall Products Multiple Vulnerabilities
- SECTRACK ID: 1010144: Symantec Client Firewall SYMDNS.SYS Driver Lets Remote Users Execute Arbitrary Code to Take Full Control of the System
- SECTRACK ID: 1010145: Symantec Client Security SYMDNS.SYS Driver Lets Remote Users Execute Arbitrary Code to Take Full Control of the System
- SECTRACK ID: 1010146: Norton AntiSpam SYMDNS.SYS Driver Lets Remote Users Execute Arbitrary Code to Take Full Control of the System
- US-CERT VU#682110: Multiple Symantec firewall products fail to properly process DNS response packets
Platforms Affected:
- Symantec Client Firewall 5.01
- Symantec Client Firewall 5.1.1
- Symantec Client Security 1.0
- Symantec Client Security 1.1
- Symantec Client Security 2.0 SCF 7.1
- Symantec Norton AntiSpam 2004
- Symantec Norton Internet Security 2002 Professional
- Symantec Norton Internet Security 2002
- Symantec Norton Internet Security 2003
- Symantec Norton Internet Security 2003 Professional
- Symantec Norton Internet Security 2004 Professional
- Symantec Norton Internet Security 2004
- Symantec Norton Personal Firewall 2002
- Symantec Norton Personal Firewall 2003
- Symantec Norton Personal Firewall 2004
Reported:
May 12, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net