[NT] Symantec Ghost Multiple DoS Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Symantec Ghost Multiple DoS Vulnerabilities
------------------------------------------------------------------------


SUMMARY

Symantec
<http://www.symantec.com/enterprise/products/overview.jsp?pcid=1025&pvid=865_1 > Ghost Solution Suite is "an enterprise disk imaging software that allows administrators to remotely back-up and restore client computers from a central server".

Remote exploitation of multiple denial of service vulnerabilities in
Symantec Corp.'s Ghost allow remote attackers to crash the Ghost service.

DETAILS

Vulnerable Systems:
* Symantec Ghost version 8.0.992 (as supplied with Ghost Solution Suite).

These vulnerabilities affect both the client and server daemons due to
what looks like a shared communications library. The daemons listen on UDP
ports 1346, and 1347 respectively.

By sending a malformed UDP-based request to either service, an attacker
can cause the service to crash due to an invalid memory reference. This
condition can be caused by any of several unique requests. In each case,
the particular cause for the access violation varies.

Exploitation allows remote attackers to crash the Ghost client or server
applications.

The UDP packets can be multicast to an entire sub-net taking down all
processes with one packet. Authentication is not required. Since it is a
UDP packet, it is trivial for the attacker to mask the origin of the
attack by forging the source IP address in the packet header.

By default, the Ghost services are not set to auto restart in the event of
failure. Regardless, exploitation would likely abort any Ghost procedures
currently in progress when the crash occurred.

Workaround:
Employing firewalls to limit access to the client and server daemons can
help prevent exploitation of these vulnerabilities. However, attackers
could potentially bypass firewall rules by forging the origin of attack.

Vendor Status:
Symantec has addressed this vulnerability with a software update. For more
information consult their advisory at the following URL.
<http://www.symantec.com/avcenter/security/Content/2007.06.05b.html>
http://www.symantec.com/avcenter/security/Content/2007.06.05b.html

Disclosure Timeline:
* 12/13/2006 - Initial vendor notification
* 12/13/2006 - Initial vendor response
* 06/05/2007 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by iDefense.
The original article can be found at:

<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=540>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=540



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NEWS] NetPerformer Frame Relay Access Device (FRAD) ACT Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... NetPerformer Frame Relay Access Device ACT Multiple Vulnerabilities ... attackers to cause the server to crash. ...
    (Securiteam)
  • [NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow ... Remote exploitation of multiple buffer overflow vulnerabilities in ... rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions, rxsDeleteFile, ...
    (Securiteam)
  • [NT] Novell eDirectory Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory Multiple Vulnerabilities ... Three different vulnerabilities were discovered in Novell's eDirectory ... NCP over IP length Heap Overflow: ...
    (Securiteam)
  • [NEWS] Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities ...
    (Securiteam)
  • [UNIX] Apache HTTPD suEXEC Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache HTTPD suEXEC Multiple Vulnerabilities ... Local exploitation of multiple vulnerabilities within Apache Software ... Foundation's suexec utility could allow an attacker to execute arbitrary ...
    (Securiteam)
Quantcast