SUMMARY

A local access denial of service (DoS) issue has been identified in the Symantec SymEvent driver used in Symantec consumer and corporate/enterprise products listed below. A local user with authorized access to the targeted system can initiate a DoS in the affected Symantec application resulting in a system halt. This issue requires a system reboot to clear.

Severity
Low

AFFECTED PRODUCTS

ADDITIONAL PRODUCT INFORMATION

Note: Only the products identified above are affected by this issue. No other Symantec products are impacted. Symantec pcAnywhere 12.x versions do not ship with SymEvent and are not impacted.

ISSUES

Details
This issue, originally posted to the SecurityFocus Bugtraq mailing list, http://www.securityfocus.com/bid/20051, potentially allows the user to provide excessive arbitrary data to the Symantec SymEvent driver that could result in a system halt. Successful implementation of this DoS requires authorized local access to the targeted system. If successful, a system reboot is required to clear.

A CVE Candidate name will be requested from the Common Vulnerabilities and Exposures (CVE) initiative for this issue. This advisory will be revised accordingly upon receipt of the CVE Candidate name. This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems

MITIGATION

Symantec Response
Symantec engineers have reviewed the identified issue. While the issue impacts earlier versions of the Symantec SymEvent driver, it does not impact the latest released SymEvent driver versions.

Symantec recently released the updated SymEvent drivers listed in the table above through Symantec's LiveUpdate, the Corporate/Enterprise Support site, and on our public ftp servers. The SymEvent driver updates will be shipped as part of the next Maintenance Update for affected Corporate/Enterprise products. Customers who want to update their SymEvent Driver versions manually may do so through the support download site as described below.

Symantec product users who normally run frequent regular LiveUpdates should already have the latest SymEvent driver. However, to ensure all available updates have been properly applied to Symantec products, users need to run a manual LiveUpdate as follows:
 

• Open any installed Symantec product
• Click on LiveUpdate in the GUI
• Run LiveUpdate until all available Symantec product updates are downloaded and installed
• A system reboot is required following a successful SymEvent update before the update takes effect.

Enterprise and Corporate customers can download the latest SymEvent Installer from the Platinum Support web site. The updates are also available on our public ftp site

ftp://ftp.symantec.com/public/english_us_canada/symevnt/

A system reboot will be required following successful installation of the updated SymEvent driver before the update takes effect.

Symantec recommends the following Best Practices to enhance protection of your systems to unauthorized access.
 

• Restrict access to administration or management systems to authorized privileged users only
• Block remote access to all ports not essential for efficient operation
• Restrict remote access, if required, to trusted/authorized systems only
• Remove/disable unnecessary accounts or restrict access according to security policy as required
• Do not allow unauthorized individuals access to your system
• Keep vendor-supplied patches for all application software and operating systems up-to-date.
• Exercise caution when visiting unknown/untrusted websites or opening unknown URL links.
• Do not open unidentified attachments or executables from unknown sources or that you didn't request.
• Always err on the side of caution. Even if the sender is known, the source address may be spoofed.
• If in doubt, contact the sender to confirm they sent the attachment and why before opening the attachment. If still in doubt, delete the attachment.
• Run under the principle of least privilege where possible
• Follow a multi-layered approach to security. Run both firewall and antivirus applications, at a minimum, to provide multiple points of detection and protection to both inbound and outbound threats