Symantec Firewall/VPN UDP scan denial of service

symantec-firewallvpn-udp-dos (17469) The risk level is classified as MediumMedium Risk

Description:

Symantec Firewall/VPN Appliance is vulnerable to a denial of service attack. By performing a UDP port scan on the device's WAN interface, a remote attacker could cause the device to stop responding. The device must be reset to regain normal functionality.


Consequences:

Denial of Service

Remedy:

Upgrade to the latest firmware build (1.63 or later), as listed in Symantec Security Response SYM04-013. See References.

References:

  • BugTraq Mailing List, Wed Sep 22 2004 - 13:50:12 CDT: Multiple Vulnerabilities in Symantec Enterprise Firewall/Gateway Security Products.
  • Symantec Security Response SYM04-013: Symantec Enterprise Firewall/VPN and Gateway Security 300 Series Appliances Multiple Issues.
  • BID-11237: Symantec Enterprise Firewall/VPN Appliance Multiple Remote Vulnerabilities
  • CVE-2004-1472: Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 allow remote attackers to cause a denial of service (device freeze) via a fast UDP port scan on the WAN interface.
  • OSVDB ID: 10204: Symantec Enterprise Firewall/VPN Appliance UDP Port Scan DoS
  • SA12635: Symantec Firewall/VPN Products Multiple Vulnerabilities
  • US-CERT VU#441078: Symantec Firewall/VPN appliance vulnerable to DoS via UDP port scan

Platforms Affected:

  • Symantec Firewall VPN Appliance 100
  • Symantec Firewall VPN Appliance 200
  • Symantec Firewall VPN Appliance 200R
  • Symantec Nexland ISB Soho Firewall Appliance
  • Symantec Nexland Pro100 Firewall Appliance
  • Symantec Nexland Pro400 Firewall Appliance
  • Symantec Nexland Pro800 Firewall Appliance
  • Symantec Nexland Pro800Turbo Firewall Appliance
  • Symantec Nexland WaveBase Firewall Appliance

Reported:

Sep 22, 2004

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page