WelcomeEnterpriseSmall BusinessHome & Home OfficePartnersAbout Symantec
SYM06-018
September 20, 2006
Symantec: SymEvent Driver Local Access System Denial of Service

Revision History
None

Severity
Low

RemoteNo
LocalYes
Authentication RequiredYes
Exploit publicly availableProof of Concept

Overview
A local access denial of service (DoS) issue has been identified in the Symantec SymEvent driver used in Symantec consumer and corporate/enterprise products listed below. A local user with authorized access to the targeted system can initiate a DoS in the affected Symantec application resulting in a system halt. This issue requires a system reboot to clear.

Affected Products
ProductVersionPlatformSolution
Norton Personal FirewallAll SupportedWindowsRun LiveUpdate
Norton Internet SecurityAll SupportedWindowsRun LiveUpdate
Norton AntiVirusAll SupportedWindowsRun LiveUpdate
Norton SystemWorksAll SupportedWindowsRun LiveUpdate
Symantec Client SecuritySCS 1.x, 2.x 3.0Windows Me\98\95\NT 4.0SymEvent version 11.6.8
  Windows 2003 (32-Bit) XP\2000SymEvent version 12.1.1
  Windows 2003 64 bit(64 bit version)
Symantec Client Security3.1Windows 2003 (32-Bit) XP\2000SymEvent version 12.1.1
  Windows 2003 64 bit(64 bit version )
Symantec AntiVirus Corporate EditionSAVCE 8.x, 9.x, 10.0Windows Me\98\95\NT 4.0SymEvent version 11.6.8
  Windows 2003 (32-Bit) XP\2000SymEvent version 12.1.1
  Windows 2003 64 bit(64 bit version )
Symantec AntiVirus Corporate Edition10.1Windows 2003 (32-Bit) XP\2000SymEvent version 12.1.1
  Windows 2003 64 bit(64 bit version)
Symantec pcAnywhere11.5 onlyWindowsSymEvent version 11.6.8
Symantec Host IDSAll SupportedWindowsSymEvent version 11.6.8

Note: Only the products identified above are affected by this issue. No other Symantec products are impacted. Symantec pcAnywhere 12.x versions do not ship with SymEvent and are not impacted.

Details
This issue, originally posted to the SecurityFocus Bugtraq mailing list, http://www.securityfocus.com/bid/20051, potentially allows the user to provide excessive arbitrary data to the Symantec SymEvent driver that could result in a system halt. Successful implementation of this DoS requires authorized local access to the targeted system. If successful, a system reboot is required to clear.

Symantec Response
Symantec engineers have reviewed the identified issue. While the issue impacts earlier versions of the Symantec SymEvent driver, it does not impact the latest released SymEvent driver versions.

Symantec recently released the updated SymEvent drivers listed in the table above through Symantec's LiveUpdate, the Corporate/Enterprise Support site, and on our public ftp servers. The SymEvent driver updates will be shipped as part of the next Maintenance Update for affected Corporate/Enterprise products. Customers who want to update their SymEvent Driver versions manually may do so through the support download site as described below.

Symantec product users who normally run frequent regular LiveUpdates should already have the latest SymEvent driver. However, to ensure all available updates have been properly applied to Symantec products, users need to run a manual LiveUpdate as follows:

  • Open any installed Symantec product
  • Click on LiveUpdate in the GUI
  • Run LiveUpdate until all available Symantec product updates are downloaded and installed
  • A system reboot is required following a successful SymEvent update before the update takes effect.
Enterprise and Corporate customers can download the latest SymEvent Installer from the Platinum Support web site. The updates are also available on our public ftp site

ftp://ftp.symantec.com/public/english_us_canada/symevnt/

A system reboot will be required following successful installation of the updated SymEvent driver before the update takes effect.

Symantec recommends the following Best Practices to enhance protection of your systems to unauthorized access.

  • Restrict access to administration or management systems to authorized privileged users only
  • Block remote access to all ports not essential for efficient operation
  • Restrict remote access, if required, to trusted/authorized systems only
  • Remove/disable unnecessary accounts or restrict access according to security policy as required
  • Do not allow unauthorized individuals access to your system
  • Keep vendor-supplied patches for all application software and operating systems up-to-date.
  • Exercise caution when visiting unknown/untrusted websites or opening unknown URL links.
  • Do not open unidentified attachments or executables from unknown sources or that you didn't request.
  • Always err on the side of caution. Even if the sender is known, the source address may be spoofed.
  • If in doubt, contact the sender to confirm they sent the attachment and why before opening the attachment. If still in doubt, delete the attachment.
  • Run under the principle of least privilege where possible
  • Follow a multi-layered approach to security. Run both firewall and antivirus applications, at a minimum, to provide multiple points of detection and protection to both inbound and outbound threats

CVE
A CVE Candidate name will be requested from the Common Vulnerabilities and Exposures (CVE) initiative for this issue. This advisory will be revised accordingly upon receipt of the CVE Candidate name. This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.


Symantec takes the security and proper functionality of our products very seriously. As founding members of the Organization for Internet Safety (OISafety), Symantec supports and follows the principles of responsible disclosure. Symantec also subscribes to the vulnerability disclosure guidelines outlined by the National Infrastructure Advisory Council (NIAC).

Please contact secure@symantec.com if you feel you have discovered a security issue in a Symantec product. A Symantec Product Security team member will contact you regarding your submission. Symantec strongly recommends using encrypted email for reporting vulnerability information to secure@symantec.com. The Symantec Product Security PGP key can be found at the end of this message.

Symantec has developed a Product Vulnerability Response document outlining the process we follow in addressing suspected vulnerabilities in our products. This document is available below.

Symantec-Product-Vulnerability-Response Symantec Vulnerability Response Policy Symantec Product Vulnerability Management PGP Key Symantec Product Vulnerability Management PGP Key


Copyright (c) 2009 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com.

Disclaimer
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and secure@symantec.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.


Initial Post on: Wednesday, 20-Sep-06 07:14:00
Last modified on: Wednesday, 20-Sep-06 14:44:46