Symantec Antivirus Scan Engine: Web Service Administrative Interface Buffer Overflow

1072

06 March 2020

04 October 2005

CLOSED

HIGH

10

SUMMARY

 

The remote exploitation of a buffer overflow vulnerability in the web-based Administrative Interface of the Symantec AntiVirus Scan Engine product could potentially allow remote attackers to execute arbitrary code on a targeted system

Risk Impact
HIGH

Remote Access

Yes

Local Access

No

Authentication Required

No

Exploit publicly available

No

 

AFFECTED PRODUCTS

 

Product

Version

Build

Solution

Symantec AntiVirus Scan Engine

4.0

All

SAVSE 4.3.12

Symantec AntiVirus Scan Engine

4.3

All

SAVSE 4.3.12

Symantec AntiVirus for Microsoft ISA Server 2000

4.0

All

SAVSE 4.3.12

Symantec AntiVirus for Microsoft ISA Server 2000

4.3

All

SAVSE 4.3.12

Symantec AntiVirus for Netapp Filer

4.0

All

SAVSE 4.3.12

Symantec AntiVirus for Messaging

4.3

All

SAVSE 4.3.12

Symantec AntiVirus for Netapp NetCache

4.0

All

SAVSE 4.3.12

Symantec AntiVirus for Network Attached Storage

4.3

All

SAVSE 4.3.12

Symantec AntiVirus for Bluecoat

4.0

All

SAVSE 4.3.12

Symantec AntiVirus for Caching

4.3

All

SAVSE 4.3.12

Symantec AntiVirus for Microsoft SharePoint

4.3

All

SAVSE 4.3.12

Symantec AntiVirus for Clearswift

4.0

All

SAVSE 4.3.12

Symantec AntiVirus for Clearswift

4.3

All

SAVSE 4.3.12

 

ADDITIONAL PRODUCT INFORMATION

 

Non-Affected Product(s)

Product

Version

Build

Symantec AntiVirus Scan Engine

4.1

All

 

ISSUES

 

Details
iDEFENSE Labs notified Symantec of a buffer overflow vulnerability in the Symantec AntiVirus Scan Engine that could potentially allow remote attackers to execute arbitrary code. The Symantec Scan Engine is a TCP/IP server and programming interface that enables third parties to incorporate support for Symantec content scanning technologies into their proprietary applications. The vulnerability exists in the Administrative interface to the Symantec AntiVirus Scan Engine. The vulnerability is due to insufficient validation of user input in HTTP requests passed to the Scan Engine Web Service. If a remote attacker were able to access an exposed administrative port, they could supply a maliciously crafted HTTP request that could potentially result in the execution of arbitrary code and unauthorized privileged access to the targeted system.

The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2005-2758 to this issue.
This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems

MITIGATION

 

Symantec Response
Symantec Engineers have verified this issue and made security updates available for the Symantec AntiVirus Scan Engine. Symantec strongly recommends all customers immediately apply the latest updates for their supported product versions to protect against these types of threats. Symantec is unaware of any adverse customer impact from this issue

Upgrade Information
Symantec AntiVirus Scan Engine updates are available through the Platinum Support Web Site for Platinum customers or through the FileConnect -Electronic Software Distribution web site for all licensed users.

Mitigations
Default installation instructions state that, for security reasons, customers should access the administrative interface using a switch or via a secure segment of the network. The Symantec AntiVirus Scan Engine Administration default port, 8004/tcp, should be locked down for trusted internal access only. This port can be changed, as it might conflict with existing applications in the environment. But whatever port is used for the user-interface, it should never be visible external to the network which greatly reduces opportunities for unauthorized access.

A customer may choose to completely disable the Symantec AntiVirus Scan Engine’s user-interface once it has been satisfactorily configured.

  • To disable the user interface, set the port to "0" in the user-interface and restart the Symantec AntiVirus Scan Engine.
  • To re-enable the user-interface, edit the Symantec AntiVirus Scan Engine configuration file, set the port back to 8004/tcp, or the applicable user-configured port, and restart the Symantec AntiVirus Scan Engine.

Symantec Security Response has created IPS/IDS signatures to detect and prevent attempts to exploit this issue.

Symantec ManHunt 3.0 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_MH.html

Symantec Network Security Appliance 7100 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_SNS.html

Symantec Gateway Security 2.0 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_SGS.html

Deploy network intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in detection of attacks or malicious activity related to exploitation of latent vulnerabilities.

As a part of normal best practices, users should keep vendor-supplied patches for all application software and operating systems up-to-date.

ACKNOWLEDGEMENTS

 

Symantec would like to thank iDEFENSE labs, for reporting this issue and for providing coordination while Symantec resolved the issues

REVISION

 

Revision History
10/5/2005 – updated Symantec Scan Engine-based product names to reflect current branding.