SUMMARY

Symantec’s Encryption Desktop is susceptible to memory access violations when attempting to parse specific malformed certificate files.  This could result in a possible application crash if a malicious individual could entice an authorized user to successfully click on a malformed file.

AFFECTED PRODUCTS

ISSUES

MITIGATION

Details

Symantec was notified of Symantec Encryption Desktop’s improper handling of data when parsing specifically formatted certificates.  Attempting to open such a malformed file type could potentially result in memory access violations when the application attempts to parse the file. The identified issues include memory copy and block data move read access violations. Successful exploitation of these memory read access violations would likely result in a possibility of an application crash. 

Symantec Response

The certificate file type identified as resulting in the memory read access violations is not a format that is normally used in network communications.  Attempted exploitation would only be possible if the malicious individual were able to successfully entice an authorized user to double click and attempt parsing a specifically formatted certificate that had been introduced into the user’s environment. 

However, to prevent even the low probability of success of this type of issue, Symantec engineers have released an update in Symantec Encryption Desktop 10.3.2 maintenance pack 1 addressing the issue.

Update information

Customers may obtain Symantec Desktop Encryption maintenance updates through their normal Symantec support locations.

Best Practices

As part of normal best practices, Symantec strongly recommends:

• Restrict access to administration or management systems to privileged users.
• Disable remote access if not required or restrict it to trusted/authorized systems only.
• Where possible, limit exposure of application and web interfaces to trusted/internal networks only.
• Keep all operating systems and applications updated with the latest vendor patches.
• Follow a multi-layered approach to security. Run both firewall and anti-malware applications, at a minimum, to provide multiple points of detection and protection to both inbound and outbound threats.
• Deploy network and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in detection of attacks or malicious activity related to exploitation of latent vulnerabilities

ACKNOWLEDGEMENTS

Symantec thanks Jeremy Brown (jerbrown) of ReSP working through Microsoft Vulnerability Research, MSVR, for reporting this and working with us as we addressed it.

REFERENCES

BID: Security Focus, http://www.securityfocus.com, has assigned a Bugtraq ID (BID) to this issue for inclusion in the Security Focus vulnerability database.

CVE: This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.