EEYE: Symantec Multiple Firewall TCP Options Denial of Service

From: Derek Soeder (dsoeder_at_EEYE.COM)
Date: 04/23/04

  • Next message: Manskopf, Michael: "Issue With W2K SP3 Citrix/Terminal Servers and MS04-011(835732)" 
    Date:         Fri, 23 Apr 2004 11:36:06 -0700
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Symantec Multiple Firewall TCP Options Denial of Service

    Release Date:
    April 23, 2004

    Date Reported:
    March 9th, 2004

    Severity:
    High (Remote Denial of Service)

    Vendor:
    Symantec

    Systems Affected:
    Symantec Norton Internet Security 2003
    Symantec Norton Internet Security 2004
    Symantec Norton Internet Security Professional 2003
    Symantec Norton Internet Security Professional 2004
    Symantec Norton Personal Firewall 2003
    Symantec Norton Personal Firewall 2004
    Symantec Client Firewall 5.01, 5.1.1
    Symantec Client Security 1.0

    Description:
    eEye Digital Security has discovered a severe denial of service
    vulnerability in the Symantec Client Firewall products for Windows. The
    vulnerability allows a remote attacker to reliably render a system
    inoperative with one single packet. Physical access is required in order
    to bring an affected system out of this "frozen" state. This specific
    flaw exists within the component that performs low level processing of
    TCP packets.

    Technical Description:
    The vulnerability exists in SYMNDIS.SYS when trying to parse through the
    TCP Options in a TCP packet. When an attacker supplies a single TCP
    packet with a TCP option of either SACK (05) or Alternate Checksum Data
    (0F) followed by a length of 00, the SYMNDIS.SYS driver enters an
    infinite loop and causes the operating system to "freeze up" to the
    point where it can no longer be accessed outside of the system itself
    nor can any part of the GUI be accessed including keyboard and mouse.
    The only way to bring the system back online is to hard boot the system
    which requires physical access of the system. The attacker only needs
    to send a single packet to any port on the system regardless of whether
    or not the port is open. This flaw is still accessible even if the
    firewall or IDS are enabled/disabled. Below is a portion of a TCP SYN
    packet (total length of 44 bytes) with a bad SACK TCP option.

    Sample Packet:
    40 00 57 4B 00 00 01 01 05 00
    |___| |___| |___| |_________|
      | | | |
      | | | TCP Options
      | | Urgent Pointer
      | Checksum
    Window Size

    The vulnerable code maintains an offset into the TCP option bytes, and
    attempts to advance past a variable-length option by adding its length
    to the offset. If the option's length field is zero, then this will
    result in an infinite loop and the machine halts completely.

    Protection:
    Retina Network Security Scanner has been updated to identify this
    vulnerability.

    Vendor Status:
    Symantec has released a patch for this vulnerability. The patch is
    available via the Symantec LiveUpdate service.

    This vulnerability has been assigned the CVE identifier CAN-2004-0375.

    Credit:
    Discovery: Karl Lynn

    Related Links:
    Retina Network Security Scanner - Free 15 Day Trial
    http://www.eeye.com/html/Products/Retina/download.html

    Greetings:
    The entire eEye family, Kelly H., Geoff and Sarah, Mike M. (Tocks),
    Dragon IDS crew, Riley's list of firewall vendors, pie in the sky
    charts, SCARFACE : Make Way for The Bad Guy!.

    Copyright (c) 1998-2004 eEye Digital Security Permission is hereby
    granted for the redistribution of this alert electronically. It is not
    to be edited in any way without express consent of eEye. If you wish to
    reprint the whole or any part of this alert in any other medium
    excluding electronic medium, please email alert@eEye.com for permission.

    Disclaimer
    The information within this paper may change without notice. Use of this
    information constitutes acceptance for use in an AS IS condition. There
    are NO warranties with regard to this information. In no event shall the
    author be liable for any damages whatsoever arising out of or in
    connection with the use or spread of this information. Any use of this
    information is at the user's own risk.

    Feedback
    Please send suggestions, updates, and comments to:

    eEye Digital Security
    http://www.eEye.com
    info@eEye.com

    -----
    Earn up to 10 credit course hours toward the TruSecure ICSA Practitioner (TICSA) Credential and receive a TICSA exam coupon by attending the Infosecurity Canada 2004 conference. Featured speaker, Marcus J. Ranum, TruSecure inventor of the proxy firewall will present on June 3 at 11:30 AM. Visit <https://ticsa.trusecure.com> for certification details and <http://www.infosecuritycanada.com> for conference information. Become TICSA certified and see what happens!
    -----

  • Next message: Manskopf, Michael: "Issue With W2K SP3 Citrix/Terminal Servers and MS04-011(835732)"

    Relevant Pages