Symantec Client Firewall DNS Response Buffer Overflow Vulnerability
10 Apr. 2012
Summary
This allow remote attackers to cause a denial of service or execute arbitrary code via (1) a manipulated length byte in the first-level decoding routine for NetBIOS Name Service (NBNS) that modifies an index variable and leads to a stack-based buffer overflow, (2) a heap-based corruption problem in an NBNS response that is missing certain RR fields, and (3) a stack-based buffer overflow in the DNS component via a Resource Record (RR) with a long canonical name (CNAME) field composed of many smaller components.
Vulnerable Systems:
* Symantec Norton Personal Firewall 2004
* Symantec Norton Personal Firewall 2003
* Symantec Norton Personal Firewall 2002
* Symantec Norton Internet Security 2004 Professional Edition
* Symantec Norton Internet Security 2004
* Symantec Norton Internet Security 2003 Professional Edition
* Symantec Norton Internet Security 2003
* Symantec Norton Internet Security 2002 Professional Edition 0
* Symantec Norton Internet Security 2002 0
* Symantec Norton AntiSpam 2004
* Symantec Client Security 2.0 (SCF 7.1)
* Symantec Client Security 1.1
* Symantec Client Security 1.0
* Symantec Client Firewall 5.1.1
* Symantec Client Firewall 5.0 1
A remotely exploitable buffer overflow vulnerability has been reported in various Symantec Firewall Products. Affected products include Norton Internet Security, Norton Personal Firewall, Norton AntiSpam, Client Firewall, and Client Security.
The issue is due to insufficient bounds checking of DNS response data and may be exploited to gain SYSTEM/kernel level access to a computer hosting the vulnerable software.
The source of the vulnerability is that the CNAME (Canonical Name) data field specified in incoming DNS Resource Records is copied into an internal buffer in an insecure manner, resulting in a stack-based buffer overflow.
Vendor Status:
Symantec as issued an update for this vulnerablity
