SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Firewall)  >   Norton Internet Security Vendors:   Symantec
(Vendor Issues Fix) Re: Symantec Norton Internet Security Can Be Crashed By Remote Users Sending ICMP Messages
SecurityTracker Alert ID:  1005945
SecurityTracker URL:  http://securitytracker.com/id/1005945
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 20 2003
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2003
Description:   A denial of service vulnerability was reported in Symantec's Norton Internet Security 2003 firewall product. A remote user may be able to cause the firewall to crash.

It is reported that a remote user can send a flood of thousands of ICMP echo request packets to the target host to cause the target host to crash. A demonstration exploit command is provided:

"ping MyIP -l 65500"

Impact:   A remote user may be able to cause the host running Symantec's Norton Internet Security to crash.
Solution:   The vendor confirms that this bug affects Norton Personal Firewall 2003, Norton Internet Security 2003, and Norton Internet Security 2003 Professional Edition, but that systems running Windows 9x, Windows ME, or Windows NT are not affected.

The vendor has released a fix, available via LiveUpdate.

Vendor URL:  www.symantec.com/sabu/nis/nis_pe/ (Links to External Site)
Cause:   State error
Underlying OS:  Windows (XP)

Message History:   This archive entry is a follow-up to the message listed below.
Jan 17 2003 Symantec Norton Internet Security Can Be Crashed By Remote Users Sending ICMP Messages



 Source Message Contents

Subject:  Re: NIS 2003 crash


On January 11, 2003 Pavel P. reported the following regarding Norton
Internet Security 2003:

---------------snip--------------------------
Subject: NIS 2003 crash


NIS2003 - I have WinXP Pro with SP1 and Norton Internet Security installed
on my machine. When I ping my machine with the following parameter:

ping "My IP" -l 65500

where "My IP" represents my IP number, the computer halts with a blue
screen error. The problem is most probably in Intrusion Detection, since
when I switch it off, the problem disappears.
Does anyone experience the same problem with NIS? I Tried to reinstall my
computer withou any effect.

---------------snip--------------------------

Reference:   Bugtraq ID 6598, Symantec Norton Internet Security ICMP Packet
Flood Denial Of Service Vulnerability

Symantec Security Response Advisory,
http://securityresponse.symantec.com/avcenter/security/Content/2003.01.17.html

17 January, 2003
Symantec Norton Internet Security ICMP Packet Flood Denial Of Service
Vulnerability

Risk
Low

Overview
Symantec is aware of an issue with the Symantec Norton Personal Firewall
2003.  A Microsoft Windows 2000 or Windows XP system with Symantec Norton
Personal Firewall 2003 installed can experience a crash when sending an
excessively large echo request.

Components Affected
Norton Personal Firewall 2003
Norton Internet Security 2003
Norton Internet Security 2003 Professional Edition

Description
On 13 January 2003, Symantec became aware of an issue originally reported
on BugTraq. By sending an excessively large echo request, a crash can occur
on a Windows 2000 or Windows XP system with Symantec Norton Personal
Firewall 2003 installed.

Symantec Response
Symantec engineers have evaluated and verified that this issue exists for
Symantec's Norton Personal Firewall 2003, Symantec's Norton Internet
Security 2003 as well as Symantec's Norton Internet Security 2003
Professional Edition. Sending this excessively large echo request results
in the overflow of an internal buffer and causes a crash of the system.
This issue does not occur on systems running Windows 9x, Windows ME or
Windows NT.

Symantec takes any product issue such as this very seriously. We have
developed an update for Symantec Norton Personal Firewall 2003, Symantec
Norton Internet Security 2003 and Symantec Norton Internet Security 2003
Professional Edition to address this issue. The update is now available via
LiveUpdate.

There are some circumstances that greatly mitigate the risk associated with
this issue. In this instance, the system is attempting to send an
excessively large echo request. Any attempt to do this requires either
local access to the targeted system to initiate the request or malicious
code that initiates the request is downloaded and executed on the target
system.

As a best practice, Symantec recommends keeping all operating systems and
applications updated with the latest vendor patches. Keeping
mission-critical systems updated with all security patches applied reduces
risk exposure. Symantec further recommends using a multi-layered approach
to security.  Users, at a minimum, should run both personal firewall and
antivirus applications to provide multiple points of detection and
protection to both inbound and outbound threats.

Users should further be wary of mysterious attachments and executables
delivered via email. Do not open attachments or executables from unknown
sources. Always err on the side of caution. Even if the sender is known, be
wary of attachments if the sender does not explain the attachment content
in the body of the email. You do not know the source of the attachment. If
in doubt, contact the sender before opening the attachment. If still in
doubt, delete the attachment without opening it.

Note: The proper contact for information and coordination regarding this
issue or any security issues with Symantec products is through
symsecurity@symantec.com.


Copyright (c) 2003 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as
it is not edited in any way unless authorized by Symantec Security
Response. Reprinting the whole or parts of this alert in any medium other
than electronically requires permission from symsecurity@symantec.com.

Disclaimer
The information in the advisory is believed to be accurate at the time of
publishing based on currently available information. Use of the information
constitutes acceptance for use in an AS IS condition. There are no
warranties with regard to this information. Neither the author nor the
publisher accepts any liability for any direct, indirect, or consequential
loss or damage arising from use of, or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and SymSecurity
are registered trademarks of Symantec Corp. and/or affiliated companies in
the United States and other countries. All other registered and
unregistered trademarks represented in this document are the sole property
of their respective companies/owners.


Symantec Security Response
symsecurity@symantec.com
http://securityresponse.symantec.com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.1

iQA/AwUBO7iRFxMwEkwA14VxEQKI8gCfWICJV9DrP5YPrcJa9dxgtSCHaaIAn3e+
WKp8AolyJgWU0eeQKBtc7tu3
=f7Si
-----END PGP SIGNATURE-----




 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC