WelcomeEnterpriseSmall BusinessHome & Home OfficePartnersAbout Symantec
SYM07-001
January 24, 2007
Symantec Web Security Multiple Vulnerability

Revision History
None

Severity
Medium

RemoteYes
Local AccessNo
Authentication RequiredYes
Exploit publicly availableNo

Overview
A Cross Site Scripting Vulnerability and a denial of service vulnerability have been discovered in the Symantec Web Security (SWS) products.

Vulnerable Products
ProductVersionupdate
Symantec Web SecurityAll version prior to 3.0.1.853.0.1.85

Details
The SWS product fails to properly check and parse for URLs that may be embedded in HTML tags within error or blocked page messages returned to the client.

An attacker could potentially embed malicious scripts commands into certain specific URLs, which the client browser would execute in the context specified in the malicious command. The vulnerable HTML pages occur with SWS error and blocked pages. Cross-site scripting vulnerabilities are Web-based attacks that target execution via the browser used to connect to the Web server. The SWS Web-based management console failed to properly check and parse its own HTML tags within error and blocked page messages that are returned to the requesting client.

This type of attack requires additional input into the data stream by a malicious input, such as a Trojan horse which could issue commands or a URL may be generated that is outside the bounds of management. For example, it may specify unavailable links or be incorrectly formatted. The security gateway will reject this URL, but in so doing will return the offending URL to the browser without proper validation. The client browser, depending on configuration, may then act on the malicious content embedded in the URL. A denial of service vulnerability has also been identified. An unauthorized user can use the license registering interface and submit a very large file to Symantec Web Security. If the unauthorized user attempted to upload an extremely large file, the subsequent processing could slow the system creating a denial of service.

Symantec Response
Symantec has corrected this issue in Symantec Web Security 3.0.1.85 and has made an update available for download. The update is available here.

Credit
Symantec thanks Mikko Korppi, for finding and reporting these issues to Symantec.


Symantec takes the security and proper functionality of our products very seriously. As founding members of the Organization for Internet Safety (OISafety), Symantec supports and follows the principles of responsible disclosure. Symantec also subscribes to the vulnerability disclosure guidelines outlined by the National Infrastructure Advisory Council (NIAC).

Please contact secure@symantec.com if you feel you have discovered a security issue in a Symantec product. A Symantec Product Security team member will contact you regarding your submission. Symantec strongly recommends using encrypted email for reporting vulnerability information to secure@symantec.com. The Symantec Product Security PGP key can be found at the end of this message.

Symantec has developed a Product Vulnerability Response document outlining the process we follow in addressing suspected vulnerabilities in our products. This document is available below.

Symantec-Product-Vulnerability-Response Symantec Vulnerability Response Policy Symantec Product Vulnerability Management PGP Key Symantec Product Vulnerability Management PGP Key


Copyright (c) 2009 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com.

Disclaimer
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and secure@symantec.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.


Initial Post on: Wednesday, 24-Jan-07 12:05:00
Last modified on: Thursday, 25-Jan-07 16:33:43