Symantec Firewall/VPN Appliance and Gateway Security UDP allows attacker to obtain information
| symantec-udp-obtain-info (17470) |  Medium Risk |
Description:
Symantec Firewall/VPN Appliance could allow a remote attacker to obtain information. By performing a UDP port scan on the device's WAN interface from UDP port 53, a remote attacker could determine if the tftpd, snmpd, and isakmp services are active.
Consequences:
Obtain Information
Remedy:
For Symantec Firewall/VPN Appliance:
Upgrade to the latest firmware build (1.63 or later), as listed in Symantec Security Response SYM04-013. See References.
For Symantec Gateway Security:
Upgrade to the latest firmware build (622 or later), as listed in Symantec Security Response SYM04-013. See References.
References:
- BugTraq Mailing List, Wed Sep 22 2004 - 13:50:12 CDT: Multiple Vulnerabilities in Symantec Enterprise Firewall/Gateway Security Products.
- Symantec Security Response SYM04-013: Symantec Enterprise Firewall/VPN and Gateway Security 300 Series Appliances Multiple Issues.
- BID-11237: Symantec Enterprise Firewall/VPN Appliance Multiple Remote Vulnerabilities
- CVE-2004-1473: Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running firmware before 622 allow remote attackers to bypass filtering and determine whether the device is running services such as tftpd, snmpd, or isakmp via a UDP port scan with a source port of UDP 53.
- CVE-2004-1474: Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running firmware before 622 uses a default read/write SNMP community string, which allows remote attackers to alter the firewall's configuration file.
- OSVDB ID: 10205: Symantec Firewall/Gateway UDP Port 53 Filter Bypass
- OSVDB ID: 10206: Symantec Firewall/Gateway Default SNMP String Allows Device Configuration Disclosure/Modification
- SA12635: Symantec Firewall/VPN Products Multiple Vulnerabilities
- US-CERT VU#173910: Multiple Symantec security appliances do not allow the SNMP read-write community string to be changed
- US-CERT VU#329230: Multiple Symantec security appliances fail to properly filter port 53/udp traffic
Platforms Affected:
- Symantec Firewall VPN Appliance 100
- Symantec Firewall VPN Appliance 200
- Symantec Firewall VPN Appliance 200R
- Symantec Gateway Security 360
- Symantec Gateway Security 360R
- Symantec Nexland ISB Soho Firewall Appliance
- Symantec Nexland Pro100 Firewall Appliance
- Symantec Nexland Pro400 Firewall Appliance
- Symantec Nexland Pro800 Firewall Appliance
- Symantec Nexland Pro800Turbo Firewall Appliance
- Symantec Nexland WaveBase Firewall Appliance
Reported:
Sep 22, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net