9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
Symantec products that ship and use a third-party Autonomy KeyView module have updated the module to address a buffer overflow vulnerability reported against the KeyView module.
Product
|
Version
|
Build
|
Solution(s)
—|—|—|—
Symantec Mail Security for Domino
|
7.5.5.32
7.5.4.29
7.5.3.25
|
All
|
7.5.6
Symantec Mail Security for Microsoft Exchange
|
5.0.11
5.0.10
|
All
|
5.0.12
Symantec Mail Security for Microsoft Exchange
|
6.0.7
6.0.6
|
All
|
6.0.8
Symantec Mail Security for SMTP
|
5.0.x
|
All
|
Apply Patch Level 201
Symantec Mail Security Appliance/ Symantec BrightMail Appliance
|
5.0.x and later
|
All
|
Upgrade to Bright Mail Appliance 8.0.0
Symantec BrightMail Appliance
|
|
All
|
Upgrade to Bright Mail Appliance 8.0.0
Symantec Data Loss Prevention Detection Servers/Enforce
|
7.x
|
All
|
Hotfix_7.2.0.37
Symantec Data Loss Prevention Detection Servers/Enforce
|
8.0
|
All
|
Hotfix_8.0.10.38_1
Symantec Data Loss Prevention Endpoint Agents
|
8.0
|
All
|
Hotfix_8.0.10.38_2
Symantec Data Loss Prevention Detection Servers/Enforce for Windows
|
8.1.x
|
All
|
Hotfix_8.1.5.15_Windows
Symantec Data Loss Prevention Detection Servers/Enforce for Linux
|
8.1.x
|
All
|
Hotfix_8.1.5.15_Linux
Symantec Data Loss Prevention Endpoint Agents
|
8.1.x
|
All
|
Hotfix_8.1.6.2
Note:
Symantec DLP 7.x Detection Servers and Enforce are affected. DLP 7.x Endpoint Agents are NOT affected.
Symantec DLP customers that need to update Symantec DLP 8.1 Detection Servers, Enforce, or Endpoint Agents MUST first update to Symantec DLP v8.1.1.
Following application of the v8.1.1 upgrade apply the Symantec DLP 8.1.x hotfixes identified above.
Products Not Affected
Product
|
Version
—|—
Symantec Mail Security for Domino
|
All versions prior to 7.5.3
Symantec Mail Security for Microsoft Exchange
|
All versions prior to 5.0.10
Symantec Mail Security for Microsoft Exchange
|
All 6.0.x versions prior to 6.0.6
Symantec Mail Security for SMTP
|
4.1
Symantec Mail Security Appliance
|
4.x
Symantec BrightMail Appliance
|
8.x
Symantec Data Loss Prevention Endpoint Agents
|
7.x
Symantec Data Loss Prevention Detection Servers/Enforce
|
9.0
Severity
High
Low for SMS for SMTP and SMS Appliance
NOTE: SMS for SMTP and BrightMail Appliance run the Autonomy KeyView module out-of- process with limited privileges reducing the impact of this issue
Remote Access
|
Yes
—|—
Local Access
|
No
Authentication Required
|
No
Exploit publicly available
|
No
Details
iDefense Labs notified Symantec of a buffer overflow vulnerability reported against the Autonomy KeyView module shipped and installed by Symantec products identified above.
Symantec Response
Symantec product engineers have implemented updates for this issue in all affected product versions.
In the Symantec Mail Security for SMTP and Symantec Mail Security/BrightMail Gateway Appliances, the Autonomy KeyView module processes are separated from the Symantec application processes (out-of-process) and have limited rights. This out-of-process method specifically addresses these types of security concerns. Any attempt to exploit the Autonomy KeyView module results in process termination of the offending thread and an error message generated to and handled by the specific application.
Symantec knows of no exploitation of or adverse customer impact from these issues.
Update Information
Updates will be available from your normal support/download locations.
SMS for Domino and Microsoft Exchange updates are available through the Platinum Support Web Site for Platinum customers or through the FileConnect -Electronic Software Distribution web site.
Symantec DLP updates are available for download through secure file exchange.
Mitigation/Workaround
Temporary Workaround for Symantec Mail Security for Domino
Installations of SMS for Domino 7.5 that do not utilize the Content Filtering capabilities of the product are not susceptible to this issue. SMS for Domino 7.5 would be susceptible only if the attachment content scanning option is enabled.
As an interim workaround, administrators unable to upgrade to the recommended solution may disable content filtering rules that contain parameters that specify scanning of attachment content. The rules do not need to be deleted, only disabled until the updated release is installed.
To disable the content filtering rules for Symantec Mail Security for Domino
Temporary Workaround for Symantec Mail Security for Microsoft Exchange
Installations of SMS for Microsoft Exchange 5.x that do not utilize the Content Filtering capabilities of the product are not susceptible. SMS for Microsoft Exchange 5.x is susceptible only if the attachment content scanning option is enabled.
As an interim workaround, administrators unable to upgrade to the recommended solution may disable content filtering rules that contain parameters that specify scanning of attachment content. The rules do not need to be deleted, only disabled until the updated release is installed.
Temporary Workaround for Symantec Mail Security for SMTP and Symantec Mail Security/Symantec BrightMail Appliance
Risk from this vulnerability is limited on installations of SMS for SMTP and SMS/SBM Appliance in which the attachment content scanning option is enabled. However, installations that do not utilize the Content Filtering capabilities of the product _are not_susceptible to this issue.
As an interim workaround, administrators unable to upgrade to the recommended solution may disable content filtering rules that contain parameters that specify scanning of attachment content. The rules do not need to be deleted, only disabled until the updated release is installed.
To disable the content filtering rules for SMS for SMTP and SMS Appliance:
Temporary Workaround for Symantec Data Loss Prevention Suite
Symantec DLP 7.x and v8.x Servers:
Best Practices
As part of normal best practices, Symantec strongly recommends:
This vulnerability was reported by an iDefense contributor who wishes to remain anonymous.
Security Focus, http://www.securityfocus.com, has assigned a Bugtraq ID (BID) 34086 to this issue for inclusion in the Security Focus vulnerability database.
This issue is a candidate for inclusion in the Common Vulnerabilities and Exposures (CVE) list (http://cve.mitre.org), which standardizes names for security problems. The CVE initiative has assigned CVE-2008-4564 to this issue.