(Vendor Issues Fix) Re: Symantec Norton Internet Security Can Be Crashed By Remote Users Sending ICMP Messages
SecurityTracker Alert ID: 1005945|
SecurityTracker URL: http://securitytracker.com/id/1005945
(Links to External Site)
Date: Jan 20 2003
Denial of service via network|
Fix Available: Yes Vendor Confirmed: Yes |
A denial of service vulnerability was reported in Symantec's Norton Internet Security 2003 firewall product. A remote user may be able to cause the firewall to crash.|
It is reported that a remote user can send a flood of thousands of ICMP echo request packets to the target host to cause the target host to crash. A demonstration exploit command is provided:
"ping MyIP -l 65500"
A remote user may be able to cause the host running Symantec's Norton Internet Security to crash.|
The vendor confirms that this bug affects Norton Personal Firewall 2003, Norton Internet Security 2003, and Norton Internet Security 2003 Professional Edition, but that systems running Windows 9x, Windows ME, or Windows NT are not affected.|
The vendor has released a fix, available via LiveUpdate.
Vendor URL: www.symantec.com/sabu/nis/nis_pe/ (Links to External Site)
|Underlying OS: Windows (XP)|
This archive entry is a follow-up to the message listed below.|
Source Message Contents
Subject: Re: NIS 2003 crash|
On January 11, 2003 Pavel P. reported the following regarding Norton
Internet Security 2003:
Subject: NIS 2003 crash
NIS2003 - I have WinXP Pro with SP1 and Norton Internet Security installed
on my machine. When I ping my machine with the following parameter:
ping "My IP" -l 65500
where "My IP" represents my IP number, the computer halts with a blue
screen error. The problem is most probably in Intrusion Detection, since
when I switch it off, the problem disappears.
Does anyone experience the same problem with NIS? I Tried to reinstall my
computer withou any effect.
Reference: Bugtraq ID 6598, Symantec Norton Internet Security ICMP Packet
Flood Denial Of Service Vulnerability
Symantec Security Response Advisory,
17 January, 2003
Symantec Norton Internet Security ICMP Packet Flood Denial Of Service
Symantec is aware of an issue with the Symantec Norton Personal Firewall
2003. A Microsoft Windows 2000 or Windows XP system with Symantec Norton
Personal Firewall 2003 installed can experience a crash when sending an
excessively large echo request.
Norton Personal Firewall 2003
Norton Internet Security 2003
Norton Internet Security 2003 Professional Edition
On 13 January 2003, Symantec became aware of an issue originally reported
on BugTraq. By sending an excessively large echo request, a crash can occur
on a Windows 2000 or Windows XP system with Symantec Norton Personal
Firewall 2003 installed.
Symantec engineers have evaluated and verified that this issue exists for
Symantec's Norton Personal Firewall 2003, Symantec's Norton Internet
Security 2003 as well as Symantec's Norton Internet Security 2003
Professional Edition. Sending this excessively large echo request results
in the overflow of an internal buffer and causes a crash of the system.
This issue does not occur on systems running Windows 9x, Windows ME or
Symantec takes any product issue such as this very seriously. We have
developed an update for Symantec Norton Personal Firewall 2003, Symantec
Norton Internet Security 2003 and Symantec Norton Internet Security 2003
Professional Edition to address this issue. The update is now available via
There are some circumstances that greatly mitigate the risk associated with
this issue. In this instance, the system is attempting to send an
excessively large echo request. Any attempt to do this requires either
local access to the targeted system to initiate the request or malicious
code that initiates the request is downloaded and executed on the target
As a best practice, Symantec recommends keeping all operating systems and
applications updated with the latest vendor patches. Keeping
mission-critical systems updated with all security patches applied reduces
risk exposure. Symantec further recommends using a multi-layered approach
to security. Users, at a minimum, should run both personal firewall and
antivirus applications to provide multiple points of detection and
protection to both inbound and outbound threats.
Users should further be wary of mysterious attachments and executables
delivered via email. Do not open attachments or executables from unknown
sources. Always err on the side of caution. Even if the sender is known, be
wary of attachments if the sender does not explain the attachment content
in the body of the email. You do not know the source of the attachment. If
in doubt, contact the sender before opening the attachment. If still in
doubt, delete the attachment without opening it.
Note: The proper contact for information and coordination regarding this
issue or any security issues with Symantec products is through
Copyright (c) 2003 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as
it is not edited in any way unless authorized by Symantec Security
Response. Reprinting the whole or parts of this alert in any medium other
than electronically requires permission from email@example.com.
The information in the advisory is believed to be accurate at the time of
publishing based on currently available information. Use of the information
constitutes acceptance for use in an AS IS condition. There are no
warranties with regard to this information. Neither the author nor the
publisher accepts any liability for any direct, indirect, or consequential
loss or damage arising from use of, or reliance on, this information.
Symantec, Symantec products, Symantec Security Response, and SymSecurity
are registered trademarks of Symantec Corp. and/or affiliated companies in
the United States and other countries. All other registered and
unregistered trademarks represented in this document are the sole property
of their respective companies/owners.
Symantec Security Response
-----BEGIN PGP SIGNED MESSAGE-----
----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.1
-----END PGP SIGNATURE-----