10/5/2005 – updated Symantec Scan Engine-based product names to reflect current branding.
|Exploit publicly available||No|
The remote exploitation of a buffer overflow vulnerability in the web-based Administrative Interface of the Symantec AntiVirus Scan Engine product could potentially allow remote attackers to execute arbitrary code on a targeted system.
|Symantec AntiVirus Scan Engine||4.0||All||SAVSE 4.3.12|
|Symantec AntiVirus Scan Engine||4.3||All||SAVSE 4.3.12|
|Symantec AntiVirus for Microsoft ISA Server 2000||4.0||All||SAVSE 4.3.12|
|Symantec AntiVirus for Microsoft ISA Server 2000||4.3||All||SAVSE 4.3.12|
|Symantec AntiVirus for Netapp Filer||4.0||All||SAVSE 4.3.12|
|Symantec AntiVirus for Messaging||4.3||All||SAVSE 4.3.12|
|Symantec AntiVirus for Netapp NetCache||4.0||All||SAVSE 4.3.12|
|Symantec AntiVirus for Network Attached Storage||4.3||All||SAVSE 4.3.12|
|Symantec AntiVirus for Bluecoat||4.0||All||SAVSE 4.3.12|
|Symantec AntiVirus for Caching||4.3||All||SAVSE 4.3.12|
|Symantec AntiVirus for Microsoft SharePoint||4.3||All||SAVSE 4.3.12|
|Symantec AntiVirus for Clearswift||4.0||All||SAVSE 4.3.12|
|Symantec AntiVirus for Clearswift||4.3||All||SAVSE 4.3.12|
|Symantec AntiVirus Scan Engine||4.1||All|
iDEFENSE Labs notified Symantec of a buffer overflow vulnerability in the Symantec AntiVirus Scan Engine that could potentially allow remote attackers to execute arbitrary code. The Symantec Scan Engine is a TCP/IP server and programming interface that enables third parties to incorporate support for Symantec content scanning technologies into their proprietary applications. The vulnerability exists in the Administrative interface to the Symantec AntiVirus Scan Engine. The vulnerability is due to insufficient validation of user input in HTTP requests passed to the Scan Engine Web Service. If a remote attacker were able to access an exposed administrative port, they could supply a maliciously crafted HTTP request that could potentially result in the execution of arbitrary code and unauthorized privileged access to the targeted system.
Symantec Engineers have verified this issue and made security updates available for the Symantec AntiVirus Scan Engine. Symantec strongly recommends all customers immediately apply the latest updates for their supported product versions to protect against these types of threats. Symantec is unaware of any adverse customer impact from this issue
Symantec AntiVirus Scan Engine updates are available through the Platinum Support Web Site for Platinum customers or through the FileConnect -Electronic Software Distribution web site for all licensed users.
Default installation instructions state that, for security reasons, customers should access the administrative interface using a switch or via a secure segment of the network. The Symantec AntiVirus Scan Engine Administration default port, 8004/tcp, should be locked down for trusted internal access only. This port can be changed, as it might conflict with existing applications in the environment. But whatever port is used for the user-interface, it should never be visible external to the network which greatly reduces opportunities for unauthorized access.
A customer may choose to completely disable the Symantec AntiVirus Scan Engine’s user-interface once it has been satisfactorily configured.
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2005-2758 to this issue.
This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
Symantec would like to thank iDEFENSE labs, for reporting this issue and for providing coordination while Symantec resolved the issues.