[NT] Sygate Enforcer Discovery Packet DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 08/11/04

  • Next message: SecuriTeam: "[NT] Sygate Enforcer Unauthenticated Broadcast Bypassing" 
    To: list@securiteam.com
Date: 11 Aug 2004 17:11:43 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Sygate Enforcer Discovery Packet DoS
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.sygate.com/products/universal_enforcement.htm> Sygate
    Enforcers are described as "network gateway devices that enforce host
    integrity at network access points". Architecturally they function as an
    authenticated, packet-filtering firewall device. The Enforcer interacts
    with the Sygate Security Agent (SAA [the personal firewall component])
    product and limits access to protected networks/hosts to authenticated
    clients that comply with a predefined policy.

    In practice, the Enforcer device uses a number of proprietary protocol
    exchanges to communicate with other Enforcers and also the SAA product. By
    sending a packet containing a malformed payload to the Enforcer, the host
    service can be forced to stop responding.

    DETAILS

    Vulnerable Systems:
     * Sygate Enforcer version 4.0 and prior

    The Sygate Enforcer product sends a discovery packet at one-second
    intervals on all interfaces that have IP bound to them. The packet is a
    UDP datagram, from source port 39999 to destination port 39999, and is
    sent to the local subnet broadcast address.

    If this packet is malformed and replayed to the Enforcer, it will cause
    the Enforcer service to stop unexpectedly, without generating an entry
    within the product's audit trail.

    It is worth noting that the packet that is replayed does not need to be
    sent to the local subnet broadcast address, and can be happily sent to any
    valid Unicast address associated with the Enforcer. This means that the
    attacker does not need to be local to the Enforcer to exploit this issue.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0931>
    CAN-2003-0931

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:martin.oneal@corsaire.com>
    Martin O'Neal.
    The original article can be found at:
    <http://www.corsaire.com/advisories/c031120-001.txt>
    http://www.corsaire.com/advisories/c031120-001.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Sygate Enforcer Unauthenticated Broadcast Bypassing"

    Relevant Pages