Change CountryUnited States
  • Shopping
  1. /
  2. Security Response/
  3. Security Updates Detail
  • Add

Security Advisories Relating to Symantec Products - Symantec Veritas Enterprise Administrator service (vxsvc) buffer overflows

SYM11-010

August 15, 2011



  

Revision History

 

None

 

Severity

High

CVSS V2 Base Score: 8.33

Impact 10, Exploitability 6.5

CVSS v2 Base Vector: AV:A/AC:L/Au:N/C:C/I:C/A:C

Exploit publicly available

No

Overview

Veritas Enterprise Administrator service (vxsvc) shipped with multiple Symantec products is prone to buffer overflows which could result in arbitrary code execution in the context of system user.

 

Products Affected

 

Product

Version

Platform

Solution

Veritas Storage Foundation for Windows

5.0, 5.0RP1, 5.0RP2, 5.1, 5.1SP1, 5.1SP2

Windows 2000, Windows 2003, Windows 2008

Refer TECH165536

Veritas Storage Foundation for Windows High Availability (SFWHA)

5.0, 5.0RP1, 5.0RP2, 5.1, 5.1SP1, 5.1SP2

Windows 2000, Windows 2003, Windows 2008

Refer TECH165536

Veritas Storage Foundation (SF)

3.5 (HP-UX only), 4.1 (HP-UX only), 5.0, 5.0.1, 5.0MP1, 5.0MP2, 5.0MP3, 5.1, 5.1SP1

All supported platforms

Refer TECH165536

Veritas Storage Foundation for High Availability (SFHA)

5.0, 5.0.1, 5.0MP1, 5.0MP2, 5.0MP3, 5.1, 5.1SP1

All supported platforms

Refer TECH165536

Veritas Storage Foundation for Oracle (SFO)

5.0, 5.0.1, 5.0MP1, 5.0MP2, 5.0MP3, 5.1, 5.1SP1

All supported platforms

Refer TECH165536

Veritas Storage Foundation for DB2

5.0, 5.0.1, 5.0MP1, 5.0MP2, 5.0MP3, 5.1, 5.1SP1

All supported platforms

Refer TECH165536

Veritas Storage Foundation for Sybase

5.0, 5.0.1, 5.0MP1, 5.0MP2, 5.0MP3, 5.1, 5.1SP1

Solaris

Refer TECH165536

Veritas Storage Foundation for Real Application Cluster (SFRAC)

5.0, 5.0.1, 5.0MP1, 5.0MP2, 5.0MP3, 5.1, 5.1SP1

All supported platforms

Refer TECH165536

Veritas Storage Foundation Cluster File System (SFCFS)

5.0, 5.0.1, 5.0MP1, 5.0MP2, 5.0MP3, 5.1, 5.1SP1

All supported platforms

Refer TECH165536

Veritas Storage Foundation Cluster File System Enterprise for Oracle RAC (SFCFSORAC)

5.0 MP2, 5.0 MP3, 5.0 MP4, 5.0 RU3, 5.0 RU4, 5.1, 5.1 SP1 RP1, 5.1 SP1 RP2

Linux

Refer TECH165536

Veritas Dymanic Multi-Pathing (DMP)

5.1

Windows

Refer TECH165536

Symantec NetBackup PureDisk

6.5.x, 6.6, 6.6.0.x, 6.6.1, 6.6.1.x

Linux

Refer TECH165536

 

 

Note

  • Product versions prior to those listed above are NOT supported. Customers running legacy product versions should upgrade and apply available updates.
  • Only the versions listed above are affected
  • Symantec FileStore (SFS) is not affected in the default configuration

Details

Tipping Point ZDI notified Symantec of buffer overflow vulnerabilities in the Veritas Enterprise Administrator service (vxsvc) shared component shipped with multiple Symantec products. These overflows are caused by failure to properly validate incoming data. If successful, an attacker could potentially leverage these issues to execute arbitrary code with administrative privileges on the targeted system.

 

Symantec Response

Symantec engineers have verified these vulnerabilities exist in the versions listed in the above table. These vulnerabilities have been addressed in all supported versions. Symantec engineers did additional reviews, and will continue on-going review of related functionality to further enhance overall security of the Veritas Enterprise Administrator service (vxsvc) and to eliminate any additional potential concerns. The affected port should not be available external to the network in the default configuration, so would require access to the network environment to attempt to exploit.

 

Symantec recommends all customers update affected products (refer the above table for update details) as soon as possible to protect against potential attempts to exploit these issues.

 

Symantec is not aware of any exploitation of, or adverse customer impact from these issues.

Mitigation/Workaround

Refer TECH165536 for workaround details.

 

Best Practices

As part of normal best practices, Symantec strongly recommends:

  • Restrict access to administration or management systems to privileged users.
  • Disable remote access or restrict it to trusted/authorized systems only.
  • Keep all operating systems and applications updated with the latest vendor patches.
  • Follow a multi-layered approach to security. Run both firewall and anti-malware applications, at a minimum, to provide multiple points of detection and protection to both inbound and outbound threats.
  • Deploy network and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in detection of attacks or malicious activity related to exploitation of latent vulnerabilities

Credit

Luigi Auriemma reported this to Symantec via TippingPoint’s ZeroDay Initiative. Symantec would like to thank TippingPoint ZDI for reporting these issues and providing co-ordination while Symantec resolved it.

 

References

BID: Security Focus, http://www.securityfocus.com, has assigned a Bugtraq ID (BID) 49014 to these issues for inclusion in the Security Focus vulnerability database.

CVE: These issues are a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. The CVE initiative has assigned CVE-2011-0547.

 

Symantec takes the security and proper functionality of our products very seriously. As founding members of the Organization for Internet Safety (OISafety), Symantec supports and follows responsible disclosure guidelines.
Please contact secure@symantec.com if you feel you have discovered a security issue in a Symantec product. A member of the Symantec Product Security team will contact you regarding your submission to coordinate any required response. Symantec strongly recommends using encrypted email for reporting vulnerability information to secure@symantec.com. The Symantec Product Security PGP key can be found at the location below.
Symantec has developed a Product Vulnerability Response document outlining the process we follow in addressing suspected vulnerabilities in our products. This document is available below.
Symantec Vulnerability Response Policy
Symantec Product Vulnerability Management PGP Key Symantec Product Vulnerability Management PGP Key

Copyright (c) by Symantec Corp.

Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Product Security. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com

Disclaimer

The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Symantec, Symantec products, Symantec Product Security, and secure@symantec.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.
* Signature names may have been updated to comply with an updated IPS Signature naming convention. See http://www.symantec.com/business/support/index?page=content&id=TECH152794&key=54619&actp=LIST for more information.
Last modified on: August 15, 2011
Security Response Blog
The State of Spam
©1995 - 2013 Symantec Corporation