lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 28 Jan 2011 12:31:04 -0700
From: noreply@...us.com
To: bugtraq@...urityfocus.com
Subject: TELUS Security Labs VR - Symantec Antivirus Intel Alert Handler
	Service Denial of Service

Symantec Antivirus Intel Alert Handler Service Denial of Service

TSL ID: FSC20101213-06

1. Affected Software

     Symantec Antivirus Corporate Edition 10.1.8.8000 and possibly prior
     Symantec System Center 10.1.8.8000 and possibly prior

Reference: http://www.symantec.com/business/antivirus-corporate-edition

2. Vulnerability Summary

A denial of service vulnerability exists in Symantec Antivirus Intel Alert Handler service. Remote unauthenticated attackers can exploit this vulnerability by sending a malicious packet to the target service.


3. Vulnerability Analysis

The Alert Management System (AMS) component of Symantec Antivirus Corporate Edition installs an alert handler service, HNDLRSVC, that listens for commands from the AMS server. This service does not perform proper input validation of the command arguments while parsing parameters in the AMSGetPastParamList function. Remote unauthenticated attackers could exploit this vulnerability by sending a crafted packet, with overly long parameter size values, via the MSGSYS.EXE service on port 38292/TCP.


4. Vulnerability Detection

TELUS Security Labs has confirmed the vulnerability in:

     Symantec Antivirus Corporate Edition 10.1.8.8000
     Symantec System Center 10.1.8.8000

5. Workaround

Disable the AMS service, or update to the non-vulnerable version of Symantec Antivirus 11.x series which does not include the vulnerable AMS component.

6. Vendor Response

Patches have been made available by the vendor to eliminate this vulnerability:

http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_01

7. Disclosure Timeline

  2009-10-01 Reported to the vendor
  2009-10-20 Vendor response
  2011-01-26 Coordinated public disclosure

8. Credits

Junaid Bohio of Vulnerability Research Team, TELUS Security Labs

9. References

  CVE: CVE-2010-0111

  Vendor: http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_01

  http://telussecuritylabs.com/threats/show/FSC20101213-06

10. About TELUS Security Labs

TELUS Security Labs, formerly Assurent Secure Technologies is the leading provider of security research. Our research services include:

    * Vulnerability Research
    * Malware Research
    * Signature Development
    * Shellcode Exploit Development
    * Application Protocols
    * Product Security Testing
    * Security Content Development (parsers, reports, alerts)

TELUS Security Labs provides a specialized portfolio of services to assist security product vendors with newly discovered commercial product vulnerabilities and malware attacks. Many of our services are provided on a subscription basis to reduce research costs for our customers. Over 50 of the world's leading security product vendors rely on TELUS Security Labs research.

http://telussecuritylabs.com

Powered by blists - more mailing lists