SMTP Binding Configuration Settings Bypassed

SUMMARY Symantec responded to a potential vulnerability identified in the SMTP binding function of the entry-level Symantec Gateway Security appliances with the ISP load-balancing capabilities. In certain firmware versions, the SMTP outbound email traffic would be load-balanced regardless of the...

CVE-2004-1694

The CVE-2004-1694 entry concerns Symantec ON Command CCM 5.4.x and iCommand 3.0.x that ships with four default usernames and passwords, including one hardcoded credential. This design allows remote attackers to gain unauthorized access. Public references confirm the issue, but the provided docume...

CVE-2004-1694

Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain unauthorized access...

CVE-2004-1472

Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R with firmware older than 1.63 are vulnerable to a remote denial of service (device freeze) via a fast UDP port scan on the WAN interface. The available sources confirm the affected models and firmware range but do not provide addition...

CVE-2004-1473

CVE-2004-1473 affects Symantec Enterprise Firewall/VPN Appliances (models 100, 200, 200R) and Gateway Security devices (320, 360, 360R) with firmware versions before 1.63 (or 622 respectively). The issue allows remote attackers to bypass filtering and determine if services such as tftpd, snmpd, o...

CVE-2004-1474

This CVE pertains to Symantec Enterprise Firewall/VPN Appliances (models 100, 200, 200R) with firmware before 1.63 and Gateway Security appliances (320, 360, 360R) with firmware before 622. The underlying issue is a default read/write SNMP community string, which lets an unauthenticated remote at...

CVE-2004-1474

Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running firmware before 622 uses a default read/write SNMP community string, which allows remote attackers to alter the firewall's configuration file...

CVE-2004-1483

Multiple unknown vulnerabilities in the ActiveX and HTML file browsers in Symantec Clientless VPN Gateway 4400 Series 5.0 have unknown attack vectors and unknown impact...

CVE-2004-1473

Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running firmware before 622 allow remote attackers to bypass filtering and determine whether the device is running services such as tftpd, snmpd, or isakmp via a UDP...

CVE-2004-1483

The CVE covers multiple unknown vulnerabilities in the ActiveX and HTML file browsers of Symantec Clientless VPN Gateway 4400 Series 5.0. The description indicates unknown attack vectors and unknown impact; no details on root cause, affected versions beyond 5.0, exploits, or remediation are provi...

SYM05-003 Symantec UPX Parsing Engine Heap Overflow

Symantec Security Advisory SYM05-003 08 February, 2005 Symantec UPX Parsing Engine Heap Overflow Revision History 2/9/2005 - Updated Vulnerability details and mitigations. Updated CVE Candidate Number 2/11/2005 - Configuration modifications tested and added to disable vulnerable module in SAVCE a...

Symantec products vulnerable to buffer overflow via a specially crafted UPX file

Overview The Symantec AntiVirus Library DEC2EXE component is vulnerable to remote arbitrary code execution. Description The Symantec AntiVirus Library is used in many Symantec and third-party virus scanning products, including Symantec Norton Antivirus and Symantec BrightMail AntiSpam.The AntiVir...

ISS Protection Advisory: Symantec Antivirus Library Heap Overflow

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Protection Brief February 8, 2005 Symantec AntiVirus Library Heap Overflow Summary: ISS has shipped protection for a flaw X-Force has discovered in Symantec AntiVirus Library. The Symantec AntiVirus Library is widely relied upon to...

Symantec UPX Parsing Engine Heap Overflow

SUMMARY Symantec resolved a potential remote access compromise vulnerability reported by ISS X-Force. The vulnerability was identified in an early version of a Symantec antivirus scanning module responsible for parsing UPX compressed files that is still in limited use in some Symantec security...

CVE-2005-0249

Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header...

CVE-2005-0249

Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header...

Immunity Canvas: NORTON_UPX

Name| nortonupx ---|--- CVE| CVE-2005-0249 Exploit Pack| CANVAS Description| nortonupx Notes| CVE Name: CVE-2005-0249 Found by: Alex Wheeler VENDOR: Symantec URL: http://xforce.iss.net/xforce/alerts/id/187 VersionsAffected: Any 2004 Repeatability: This is a one shot exploit, but the process won't...

CVE-2005-0249

Concretely affected: Symantec AntiVirus/Scan Engine DEC2EXE parsing engine (DEC2EXE.dll) used in the Symantec Antivirus Library. Issue: a heap-based buffer overflow caused by improper bounds checking when parsing UPX-compressed files, triggered by a crafted UPX file with a negative virtual offset...

Symantec Brightmail Anti-Spam Spamhunter UTF encoding error

Overview Symantec Brightmail Anti-Spam Spamhunter crashes when trying to convert certain valid character sets to UTF, resulting in a denial-of-service condition. Description Brightmail Anti-Spam Spamhunter is a spam filter designed for corporate environments. The Brightmail Anti-Spam Spamhunter...

CVE-2004-0369

Buffer overflow in Entrust LibKmp ISAKMP library, as used by Symantec Enterprise Firewall 7.0 through 8.0, Gateway Security 5300 1.0, Gateway Security 5400 2.0, and VelociRaptor 1.5, allows remote attackers to execute arbitrary code via a crafted ISAKMP payload...