Symantec Antivirus Intel Alert Handler Service Denial of Service Vulnerability
11 Jun. 2011
Summary
A denial of service vulnerability exists in Symantec Antivirus Intel Alert Handler service. Remote unauthenticated attackers can exploit this vulnerability by sending a malicious packet to the target service.
Vulnerable Systems:
* Symantec Antivirus Corporate Edition 10.1.8.8000
* Symantec System Center 10.1.8.8000
The Alert Management System (AMS) component of Symantec Antivirus Corporate Edition installs an alert handler service, HNDLRSVC, that listens for commands from the AMS server. This service does not perform proper input validation of the command arguments while parsing parameters in the AMSGetPastParamList function. Remote unauthenticated attackers could exploit this vulnerability by sending a crafted packet, with overly long parameter size values, via the MSGSYS.EXE service on port 38292/TCP.
Workaround:
Disable the AMS service, or update to the non-vulnerable version of Symantec Antivirus 11.x series which does not include the vulnerable AMS component.
