Symantec Security Advisory

SYM07-010

01 June, 2007

Symantec Storage Foundation Solutions Suites:  Veritas Volume Replicator, Denial of Service in Veritas Administrative Service

Revision History
None

Severity
Low

Remote Access      network access or authorized user interaction required      
Local Access      No      
Authentication Required      No      
Exploit publicly available      No      


Overview
A Denial of Service (DoS) vulnerability has been identified and resolved in the Symantec Veritas Volume Replicator (VVR) option, specifically in the administrative service.  Symantec VVR ships as a licensable option with Symantec Storage Foundation Solutions Suites. If the VVR option is installed, successful implementation of a DoS attack could terminate the service. In some circumstances, resource exhaustion as a result of the DoS could potentially lead to additional system degradation.


Products Affected and Solution Links

Veritas Volume Replicator for Windows      

         3.1 - Win2k      
         4.1, 4.1RP1 - Win2k, Win2003 32-bit      
         4.2, 4.2RP1, 4.2RP2 - Win2k, Win2003 32-bit      
         4.3, 4.3MP1 - Win2k, Win2003 32-bit, 64-bit      

        Windows: http://entsupport.symantec.com/docs/288538 


Veritas Volume Replicator for UNIX and Linux
      
      3.5 - HP-UX: http://itrc.hp.com (PHCO_35815, PHKL_35816 and PHCO_35827)


      4.0 - AIX: http://entsupport.symantec.com/docs/a286518 


      4.1 - Solaris, Solaris Opteron, HP-UX, Linux      

      Solaris: http://entsupport.symantec.com/docs/a287690 

      Solaris Opteron: http://entsupport.symantec.com/docs/288631 

      HP-UX: http://itrc.hp.com (PHCO_35890 and PHKL_35891)

      Linux: https://fileconnect.symantec.com (4.1 Maintenance Pack 4)


      5.0 - Solaris, HP-UX, Linux, AIX      

      Solaris: http://entsupport.symantec.com/docs/4890 

      HP-UX: http://entsupport.symantec.com/docs/a287634 

      Linux RHEL 4: http://entsupport.symantec.com/docs/a287432 

      Linux SLES 9: http://entsupport.symantec.com/docs/a287178 

      AIX: http://entsupport.symantec.com/docs/a287565 


Details
iDefense (http://labs.idefense.com ) notified Symantec of a DoS vulnerability identified in the Symantec VVR Administrative Service.   The DoS is caused by failure to properly validate incoming data passed to the VVR service.  A specifically crafted packet passed to the vulnerable service could result in the VVR administrative service terminating unexpectedly.  The VVR administration service will require a restart.  This type of attack could also potentially lead to degraded application functions on the targeted system or to the overall system due to excessive CPU resource consumption during memory allocation attempts prior to VVR administrative service termination.  

This DoS, if successfully exploited, will most likely be the result of an internal attack by an authorized malicious user on the network since network access would normally be required to reach the affected service port.  Any potentially successful attack by a non-authorized remote attacker will most likely be a scenario of interactive user involvement by enticing a user to run or by allowing malicious code to be run that could successfully impact a vulnerable system.


Symantec Response
Symantec takes the security of its products and customers very seriously. Symantec engineers have verified and corrected these issues in all currently supported vulnerable versions of Veritas Volume Replicator.

Updates are available for all supported products. Symantec recommends customers apply the latest product update available for their supported product versions to enhance their security posture and protect against potential security threats of this nature.


To determine if the VVR option is installed on a system

Veritas Storage Foundation Suite for Windows:
From a command prompt, run the command vxrvg.exe as system or domain administrator

If the command is not found, the VVR option is not installed and the system is not vulnerable

If the command is found, the system is vulnerable and the appropriate solution should be applied

Symantec Veritas Storage Foundation Suite for *nix
Run the command /sbin/vxlictest -n "VERITAS Volume Manager" -f "VVR as root

If the license is not found, the VVR option is not installed and the system is not vulnerable

If  the license is found, the system is vulnerable and the appropriate solution should be applied

Note:  Should you determine at a later date to install the VVR option, the appropriate updates must be applied.

Symantec knows of no exploitation of or adverse customer impact from this issue.


Best Practices
As part of normal best practices, Symantec strongly recommends:

·      Restrict access to administration or management systems to privileged users.
·      Restrict remote access, if required, to trusted/authorized systems only.
·      Run under the principle of least privilege where possible to limit the impact of exploit by threats.
·      Keep all operating systems and applications updated with the latest vendor patches.
·      Follow a multi-layered approach to security. Run both firewall and anti-malware applications at a minimum to provide multiple points of detection and protection to both inbound and outbound threats.
·      Deploy network and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in detection of attacks or malicious activity related to exploitation of latent vulnerabilities

CVE
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2007-1593 to this issue. This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org ), which standardizes names for security problems.


Credit:
Symantec would like to thank iDefense for reporting these issues and for providing full coordination while Symantec resolved them.