Symantec Client Firewall SYMNDIS.SYS TCP Options Parsing Flaw Lets Remote Users Deny Service
SecurityTracker Alert ID: 1009927|
SecurityTracker URL: http://securitytracker.com/id/1009927
(Links to External Site)
Updated: Apr 27 2004|
Original Entry Date: Apr 23 2004
Denial of service via network|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes |
Version(s): 5.01, 5.1.1|
A vulnerability was reported in the Symantec Client Firewall in the processing of TCP Options. A remote user can cause denial of service conditions on the target system.|
eEye Digital Security reported a vulnerability in several Symantec products. A remote user can reportedly send a single packet to the target system to cause the target system to hang. A physical restart of the system is required to return to normal operations.
The flaw reportedly resides in SYMNDIS.SYS. A remote user can send a single TCP packet with a TCP option of either SACK (05) or Alternate Checksum Data (0F) followed by a length of 00 to cause the SYMNDIS.SYS driver to enter an infinite processing loop, the report said. The vulnerability can be triggered regardless of whether the application is enabled or not.
The vendor was reportedly notified on March 9, 2004.
A remote user can cause denial of service conditions on the target system. A physical restart of the system is required to return to normal operations.|
The vendor has reportedly issued a fix, available via Live Update.|
Vendor URL: www.symantec.com/ (Links to External Site)
|Underlying OS: Windows (Any)|
Source Message Contents
Subject: [Full-Disclosure] EEYE: Symantec Multiple Firewall TCP Options Denial of Service|
Symantec Multiple Firewall TCP Options Denial of Service
April 23, 2004
March 9th, 2004
High (Remote Denial of Service)
Symantec Norton Internet Security 2003
Symantec Norton Internet Security 2004
Symantec Norton Internet Security Professional 2003
Symantec Norton Internet Security Professional 2004
Symantec Norton Personal Firewall 2003
Symantec Norton Personal Firewall 2004
Symantec Client Firewall 5.01, 5.1.1
Symantec Client Security 1.0
eEye Digital Security has discovered a severe denial of service
vulnerability in the Symantec Client Firewall products for Windows. The
vulnerability allows a remote attacker to reliably render a system
inoperative with one single packet. Physical access is required in order
to bring an affected system out of this "frozen" state. This specific
flaw exists within the component that performs low level processing of
The vulnerability exists in SYMNDIS.SYS when trying to parse through the
TCP Options in a TCP packet. When an attacker supplies a single TCP
packet with a TCP option of either SACK (05) or Alternate Checksum Data
(0F) followed by a length of 00, the SYMNDIS.SYS driver enters an
infinite loop and causes the operating system to "freeze up" to the
point where it can no longer be accessed outside of the system itself
nor can any part of the GUI be accessed including keyboard and mouse.
The only way to bring the system back online is to hard boot the system
which requires physical access of the system. The attacker only needs
to send a single packet to any port on the system regardless of whether
or not the port is open. This flaw is still accessible even if the
firewall or IDS are enabled/disabled. Below is a portion of a TCP SYN
packet (total length of 44 bytes) with a bad SACK TCP option.
40 00 57 4B 00 00 01 01 05 00
|___| |___| |___| |_________|
| | | |
| | | TCP Options
| | Urgent Pointer
The vulnerable code maintains an offset into the TCP option bytes, and
attempts to advance past a variable-length option by adding its length
to the offset. If the option's length field is zero, then this will
result in an infinite loop and the machine halts completely.
Retina Network Security Scanner has been updated to identify this
Symantec has released a patch for this vulnerability. The patch is
available via the Symantec LiveUpdate service.
This vulnerability has been assigned the CVE identifier CAN-2004-0375.
Discovery: Karl Lynn
Retina Network Security Scanner - Free 15 Day Trial
The entire eEye family, Kelly H., Geoff and Sarah, Mike M. (Tocks),
Dragon IDS crew, Riley's list of firewall vendors, pie in the sky
charts, SCARFACE : Make Way for The Bad Guy!.
Copyright (c) 1998-2004 eEye Digital Security Permission is hereby
granted for the redistribution of this alert electronically. It is not
to be edited in any way without express consent of eEye. If you wish to
reprint the whole or any part of this alert in any other medium
excluding electronic medium, please email alert@eEye.com for permission.
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties with regard to this information. In no event shall the
author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.
Please send suggestions, updates, and comments to:
eEye Digital Security
Full-Disclosure - We believe in it.