Symantec Antivirus Scan Engine: Web Service Administrative Interface Buffer Overflow

SUMMARY

The remote exploitation of a buffer overflow vulnerability in the web-based Administrative Interface of the Symantec AntiVirus Scan Engine product could potentially allow remote attackers to execute arbitrary code on a targeted system

Risk Impact
HIGH

Remote Access

|

Yes

—|—

Local Access

|

No

Authentication Required

|

No

Exploit publicly available

|

No

AFFECTED PRODUCTS

Product

|

Version

|

Build

|

Solution

—|—|—|—

Symantec AntiVirus Scan Engine

|

4.0

|

All

|

SAVSE 4.3.12

Symantec AntiVirus Scan Engine

|

4.3

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Microsoft ISA Server 2000

|

4.0

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Microsoft ISA Server 2000

|

4.3

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Netapp Filer

|

4.0

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Messaging

|

4.3

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Netapp NetCache

|

4.0

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Network Attached Storage

|

4.3

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Bluecoat

|

4.0

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Caching

|

4.3

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Microsoft SharePoint

|

4.3

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Clearswift

|

4.0

|

All

|

SAVSE 4.3.12

Symantec AntiVirus for Clearswift

|

4.3

|

All

|

SAVSE 4.3.12

ADDITIONAL PRODUCT INFORMATION

Non-Affected Product(s)

Product

|

Version

|

Build

—|—|—

Symantec AntiVirus Scan Engine

|

4.1

|

All

ISSUES

Details
iDEFENSE Labs notified Symantec of a buffer overflow vulnerability in the Symantec AntiVirus Scan Engine that could potentially allow remote attackers to execute arbitrary code. The Symantec Scan Engine is a TCP/IP server and programming interface that enables third parties to incorporate support for Symantec content scanning technologies into their proprietary applications. The vulnerability exists in the Administrative interface to the Symantec AntiVirus Scan Engine. The vulnerability is due to insufficient validation of user input in HTTP requests passed to the Scan Engine Web Service. If a remote attacker were able to access an exposed administrative port, they could supply a maliciously crafted HTTP request that could potentially result in the execution of arbitrary code and unauthorized privileged access to the targeted system.

The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2005-2758 to this issue.
This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems

MITIGATION

Symantec Response
Symantec Engineers have verified this issue and made security updates available for the Symantec AntiVirus Scan Engine. Symantec strongly recommends all customers immediately apply the latest updates for their supported product versions to protect against these types of threats. Symantec is unaware of any adverse customer impact from this issue

Upgrade Information
Symantec AntiVirus Scan Engine updates are available through the Platinum Support Web Site for Platinum customers or through the FileConnect -Electronic Software Distribution web site for all licensed users.

Mitigations
Default installation instructions state that, for security reasons, customers should access the administrative interface using a switch or via a secure segment of the network. The Symantec AntiVirus Scan Engine Administration default port, 8004/tcp, should be locked down for trusted internal access only. This port can be changed, as it might conflict with existing applications in the environment. But whatever port is used for the user-interface, it should never be visible external to the network which greatly reduces opportunities for unauthorized access.

A customer may choose to completely disable the Symantec AntiVirus Scan Engine's user-interface once it has been satisfactorily configured.

• To disable the user interface, set the port to “0” in the user-interface and restart the Symantec AntiVirus Scan Engine.
• To re-enable the user-interface, edit the Symantec AntiVirus Scan Engine configuration file, set the port back to 8004/tcp, or the applicable user-configured port, and restart the Symantec AntiVirus Scan Engine.

Symantec Security Response has created IPS/IDS signatures to detect and prevent attempts to exploit this issue.

Symantec ManHunt 3.0 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_MH.html

Symantec Network Security Appliance 7100 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_SNS.html

Symantec Gateway Security 2.0 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_SGS.html

Deploy network intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in detection of attacks or malicious activity related to exploitation of latent vulnerabilities.

As a part of normal best practices, users should keep vendor-supplied patches for all application software and operating systems up-to-date.

ACKNOWLEDGEMENTS

Symantec would like to thank iDEFENSE labs, for reporting this issue and for providing coordination while Symantec resolved the issues

REVISION

Revision History
10/5/2005 - updated Symantec Scan Engine-based product names to reflect current branding.