SUMMARY

Corsaire Limited discovered an issue with the way Symantec Enterprise Firewall handled SNMP notify alerts that could cause alerts to be dropped in certain instances.
 

Note: The SNMP notify daemon issue addressed by Corsaire Limited in their Advisory is NOT related to CERT Advisory CA-2002-03, Multiple Vulnerabilities in Many Implementations of the Simple Network Management Protocol (SNMP)

Reference
Corsaire Limited Security Advisory 020121-001c.txt

Risk Impact
Medium

AFFECTED PRODUCTS

Symantec Enterprise Firewall versions 6.5.x and 7.0

ISSUES

Details
Corsaire Limited notified Symantec Corporation of an issue in the way Symantec Enterprise Firewall handled some event alerts. This issue could, potentially, result in the failure of event alerts to be logged or the administrator to be notified.

Symantec Enterprise Firewall provides many methods to alert an administrator about firewall log events based on the functionality of a subsystem called the Notify daemon. One of these notification methods sends SNMP traps to the network management station where they are centrally managed. However, if the firewall log entry exceeds an established size threshold, the Notify daemon drops the SNMP trap and logs a "failed to notify" error message instead.

In the event that SNMP is the only alert mechanism used, the administrator may fail to receive notifications for which he or she has established alert criteria.

MITIGATION

Symantec Response
Symantec has verified the logging issues identified by Corsaire Limited. The problem exists in the way the Notify daemon allocates the buffer size for the SNMP traps. In certain instances, while encoding the SNMP trap, the message may exceed the allocated buffer size. In these instances, the SNMP trap is dropped and the error message is logged.
 

Note: This problem is a notification handling issue only. The issue does not allow unauthorized access to the system nor is it possible to maliciously create a DoS condition using this issue.

To address this SNMP issue, Symantec has developed hotfixes available for download for affected versions:

• Enterprise Product Support

ACKNOWLEDGEMENTS

Symantec takes the security of its products very seriously. Symantec appreciates the coordination of Martin O'Neal and Corsaire Limited in identifying and providing technical details of potential areas of concern so it can quickly address the issue