<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>Symantec Multiple Firewall Remote DNS KERNEL Overflow</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2 FACE="Courier New">Symantec Multiple Firewall Remote DNS KERNEL Overflow</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Release Date:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">May 12, 2004</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Date Reported:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">April 19, 2004</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Severity:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">High (Remote Kernel Access)</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Vendor:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Systems Affected:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Norton Internet Security 2002</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Norton Internet Security 2003</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Norton Internet Security 2004</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Norton Internet Security Professional 2002</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Norton Internet Security Professional 2003</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Norton Internet Security Professional 2004</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Norton Personal Firewall 2002</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Norton Personal Firewall 2003</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Norton Personal Firewall 2004 </FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Client Firewall 5.01, 5.1.1 </FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Client Security 1.0, 1.1, 2.0(SCF 7.1)</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec Norton AntiSpam 2004</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Description:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">eEye Digital Security has discovered a critical remote vulnerability within the Symantec firewall product line. A buffer overflow exists within a core driver component that handles the processing of DNS (Domain Name Service) requests and responses. By sending a DNS Resource Record with an overly long canonical name, a traditional stack-based buffer overflow is triggered. Successful exploitation of this flaw yields remote KERNEL access to the system.</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">With the ability to freely execute code at the Ring 0 privilege level, there are literally no boundaries for an attacker.</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">It should also be noted, that due to a separate design flaw in the firewalls handling of incoming packets, this attack can be successfully performed with all ports filtered, and all intrusion rules set.</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Technical Description:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">This specific vulnerability exists within the SYMDNS.SYS driver. The stack overflow arises due to an implementation flaw in the routine that processes the CNAME field of incoming Resource Records. A canonical name field is represented as a series of labels, and is terminated by a label with a zero byte length. Each string consists of a one byte length specifier, followed by that number of characters. A typical canonical name field would be of the following format:</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">0x03 // length </FONT>
<BR><FONT SIZE=2 FACE="Courier New">www // string component</FONT>
<BR><FONT SIZE=2 FACE="Courier New">0x04 // length </FONT>
<BR><FONT SIZE=2 FACE="Courier New">eEye // string component</FONT>
<BR><FONT SIZE=2 FACE="Courier New">0x03 // length </FONT>
<BR><FONT SIZE=2 FACE="Courier New">com // string component</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Each time the SYMDNS.SYS driver encounters a length field, the field is then used as a counter to copy the bytes that follow. These bytes are copied directly into a stack based buffer. Due to poor sanity checking on the total CNAME field, the routine will accept a large number of length specifiers and byte sequences. As the routine loops through each field, the bytes are concatenated, and an exploitable condition in the KERNEL is reached.</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">A separate design flaw allows this attack to succeed with the firewall running at it's most locked-down state. The firewall will happily accept any packet that has a source port of 53, regardless of port filtering.</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">The fact that this vulnerability is exploitable over UDP adds another serious layer to an already critical flaw.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Protection:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Retina Network Security Scanner has been updated to identify this vulnerability.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Vendor Status:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Symantec has released a patch for this vulnerability. The patch is available via the Symantec LiveUpdate service. For more information please refer to the Symantec security advisory. </FONT><A HREF="http://securityresponse.symantec.com/avcenter/security/Content/2004.05.12.html"><U><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">http://securityresponse.symantec.com/avcenter/security/Content/2004.05.12.html</FONT></U></A><FONT SIZE=2 FACE="Courier New"> </FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Credit:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Discovery: Barnaby Jack and Karl Lynn</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Related Links:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Retina Network Security Scanner - Free 15 Day Trial </FONT><A HREF="http://www.eeye.com/html/Products/Retina/download.html"><U><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">http://www.eeye.com/html/Products/Retina/download.html</FONT></U></A>
</P>
<P><FONT SIZE=2 FACE="Courier New">Greetings:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">R Hassell (aka Gilligan), the NZ crew, Gary Golomb, Rich Walchuck, Jason Dameron, Sam Stover, Matt Dickerson, and Kelly H.</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Copyright (c) 1998-2004 eEye Digital Security</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission.</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Disclaimer</FONT>
<BR><FONT SIZE=2 FACE="Courier New">The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Feedback</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Please send suggestions, updates, and comments to:</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">eEye Digital Security</FONT>
<BR><A HREF="http://www.eEye.com"><U><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">http://www.eEye.com</FONT></U></A>
<BR><FONT SIZE=2 FACE="Courier New">info@eEye.com</FONT>
</P>
<BR>
</BODY>
</HTML>