|
|
|
|
| |
Credit:
The information has been provided by iDefense Labs Security Advisories.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=539
|
| |
Vulnerable Systems:
* VERITAS Storage Foundation for Windows version 4.3.01
The vulnerability specifically exists in the handling of packets delivered to the VVR Administration service port, TCP/8199. By sending specially crafted requests to a vulnerable host, attackers are able to control the size value for memory allocation. In cases where requests are made for more memory than the system is able to allocate, the service attempts to write to an invalid pointer, which crashes the service. If allocation succeeds, the resulting memory will not be released until the connection is closed. This allows a resource consumption denial of service attack.
Analysis:
Successful exploitation of this vulnerability allows remote attackers to cause the affected service to terminate. As no checks are made that the values given make sense, it is possible to cause the service to allocate large amounts of memory, potentially causing severely degraded system performance and instability in other processes.
Crashing the administration service, which is restarted after 60 seconds, would most likely not directly impact the operation of the replication service itself. However, it likely the resource consumption variation would prevent the affected system from being usable for the duration of the attack.
Workaround:
Applying filtering to the affected port, such that only hosts an administrator uses can access it, will help mitigate exposure to the vulnerability.
Vendor response:
Symantec has addressed this vulnerability with a software update. For more information consult their advisory at the following URL: http://www.symantec.com/avcenter/security/Content/2007.06.01a.html
CVE Information:
CVE-2007-1593
Disclosure Timeline:
10/11/2006 - Initial vendor notification
10/12/2006 - Initial vendor response
06/01/2007 - Coordinated public disclosure
|
|
|
|
|
