Symantec Firewalls NBNS packet buffer overflow
| symantec-firewalls-nbns-bo (16135) |  High Risk |
Description:
Symantec Norton Internet Security and Personal Firewall devices are vulnerable to a stack-based buffer overflow. If the device is configured to allow incoming packets from UDP port 137 packets, which is not the default setting, a remote attacker could send a specially-crafted NetBIOS Name Service (NBNS) packet from UDP port 137 to overflow a buffer and execute arbitrary code on the vulnerable system.
Consequences:
Gain Access
Remedy:
A patch is available for this vulnerability through Symantec LiveUpdate, as listed in Symantec Security Response SYM04-008. See References.
References:
- Full-Disclosure Mailing List, Wed May 12 2004 - 19:01:39 CDT: EEYE: Symantec Multiple Firewall NBNS Response Processing Stack Overflow.
- Symantec Security Response SYM04-008: Symantec Client Firewall Remote Access and Denial of Service Issues.
- BID-10333: Symantec Client Firewall NetBIOS Name Service Response Buffer Overflow Vulnerability
Platforms Affected:
- Symantec Client Firewall 5.01
- Symantec Client Firewall 5.1.1
- Symantec Client Security 1.0
- Symantec Client Security 1.1
- Symantec Client Security 2.0 SCF 7.1
- Symantec Norton AntiSpam 2004
- Symantec Norton Internet Security 2002 Professional
- Symantec Norton Internet Security 2002
- Symantec Norton Internet Security 2003
- Symantec Norton Internet Security 2003 Professional
- Symantec Norton Internet Security 2004 Professional
- Symantec Norton Internet Security 2004
- Symantec Norton Personal Firewall 2002
- Symantec Norton Personal Firewall 2003
- Symantec Norton Personal Firewall 2004
Reported:
May 12, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net