Symantec products that ship a third-party Autonomy KeyView module have updated the module to address a vulnerability in the processing of Excel spreadsheets reported against the KeyView module.
Product
|
Version
|
Build
|
Solution(s)
—|—|—|—
Symantec Mail Security for Domino
|
8.0
|
All
|
SMSDOM 8.0.1
Symantec Mail Security for Domino
|
7.5.6
7.5.5.32
7.5.4.29
7.5.3.25
|
All
|
SMSDOM 7.5.7
Symantec Mail Security for Microsoft Exchange
|
6.0.8
6.0.7
6.0.6
|
All
|
SMSMSE 6.0.9
Symantec Mail Security for Microsoft Exchange
|
5.0.12
5.0.11
5.0.10
|
All
|
SMSMSE 5.0.13
Symantec Mail Security for SMTP
|
5.0.x
|
All
|
Apply Patch Level 205
Symantec Mail Security Appliance/ Symantec BrightMail Appliance
|
5.0.x and later
|
All
|
Bright Mail Appliance 8.0.2
Symantec BrightMail Appliance
|
8.0.0
8.0.1
|
All
|
Bright Mail Appliance 8.0.2
Symantec Data Loss Prevention Enforce/Detection Servers
|
7.2
|
ll
|
Hotfix_7.2.0.40_Windows
Hotfix_7.2.0.40_Linux>
Symantec Data Loss Prevention Enforce/Detection Servers for Windows
|
8.1.1
9.0.1
|
All
|
Hotfix_8.1.10.1_Windows
Hotfix_9.0.18.5_Windows
Symantec Data Loss Prevention Enforce/Detection Servers for Linux
|
8.1.1
9.0.1
|
All
|
Hotfix_8.1.10.1_Linux
Hotfix_9.0.18.5_Linux
Symantec Data Loss Prevention Endpoint Agents
|
8.1.1
|
All
|
Hotfix_8.1.10.2
Symantec Data Loss Prevention Endpoint Agents
|
9.0.1
|
All
|
Hotfix_9.0.18.9
Note:
Symantec DLP 7.x Enforce/Detection Servers are affected. DLP 7.x Endpoint Agents are NOT affected.
Symantec DLP customers that need to update Symantec DLP 8.1 Enforce/Detection Servers or Endpoint Agents MUST first update to Symantec DLP v8.1.1.
Following application of the v8.1.1 upgrade apply the Symantec DLP 8.1.x hotfixes identified above.
Products Not Affected
Product
|
Version
—|—
Symantec Mail Security for Domino
|
5.1
Symantec Mail Security for Microsoft Exchange
|
All versions prior to 5.0.10
Symantec Mail Security for Microsoft Exchange
|
All 6.0.x versions prior to 6.0.5
Symantec Mail Security for SMTP
|
4.1
Symantec Mail Security Appliance
|
4.x
Symantec Data Loss Prevention Endpoint Agents
|
7.x
Severity
Medium
NOTE: SMSME, DLP, SMSSMTP and SMS/BrightMail Appliances run the Autonomy KeyView module out-of- process with limited privileges further reducing the impact of this issue on most affected Symantec applications
Remote Access
|
Yes
—|—
Local Access
|
No
Authentication Required
|
No
Exploit publicly available
|
No
Details
iDefense Labs notified Symantec of a buffer overflow vulnerability reported against the Autonomy KeyView module shipped and installed with identified Symantec products. The overflow can occur during the processing of incoming specifically formatted Microsoft Excel spreadsheet documents.
Symantec Response
Symantec product engineers have implemented updates for this issue in all affected product versions. In many of the affected Symantec products, the Autonomy KeyView module processes have been separated from the Symantec application processes (handled out-of-process) with limited privileges on the system. This out-of-process method specifically addresses these types of security concerns. Any attempt to exploit the Autonomy KeyView module results in process termination of the offending thread and an error message generated to and handled by the specific application.
Symantec knows of no exploitation of or adverse customer impact from these issues.
Update Information
Updates will be available from your normal support/download locations.
SMS for Domino and Microsoft Exchange updates are available through the Platinum Support Web Site for Platinum customers or through the FileConnect -Electronic Software Distribution web site.
Symantec DLP updates are available for download through secure file exchange.
Mitigation/Workaround
Mitigation
Symantec Security Response has released a Bloodhound detection, Bloodhound.Exploit.243, to detect and block attempts to exploit this issue. Detections are available through LiveUpdate or from the Symantec Security Response download site, http://www.symantec.com/business/security_response/definitions.jsp.
Temporary Workaround for Symantec Mail Security for Domino
Installations of SMS for Domino 7.5 and 8.0 that do not utilize the Content Filtering capabilities of the product are not susceptible to this issue. SMS for Domino 7.5 and 8.0 would be susceptible only if the attachment content scanning option is enabled.
As an interim workaround, administrators unable to upgrade to the recommended solution may disable content filtering rules that contain parameters that specify scanning of attachment content. The rules do not need to be deleted, only disabled until the updated release is installed.
To disable the content filtering rules for Symantec Mail Security for Domino
Temporary Workaround for Symantec Mail Security for Microsoft Exchange Installations of SMS for Microsoft Exchange 5.x that do not utilize the Content Filtering capabilities of the product are not susceptible. SMS for Microsoft Exchange 5.x is susceptible only if the attachment content scanning option is enabled.
As an interim workaround, administrators unable to upgrade to the recommended solution may disable content filtering rules that contain parameters that specify scanning of attachment content. The rules do not need to be deleted, only disabled until the updated release is installed.
Temporary Workaround for Symantec Mail Security for SMTP and Symantec Mail Security/Brightmail Gateway Appliance
Risk from this vulnerability is limited on installations of SMS for SMTP and SMS Appliance in which the attachment content scanning option is enabled.However, installations that do not utilize the Content Filtering capabilities of the product are not susceptible to this issue.
As an interim workaround, administrators unable to upgrade to the recommended solution may disable content filtering rules that contain parameters that specify scanning of attachment content. The rules do not need to be deleted, only disabled until the updated release is installed.
To disable the content filtering rules for SMS for SMTP and SMS Appliance 5.x:
To disable the content filtering rules for SMS/SBM Gateway Appliance after 5.x:
Best Practices
As part of normal best practices, Symantec strongly recommends:
This issue is credited to Joshua J. Drake with iDefense Labs.
Security Focus, http://www.securityfocus.com, has assigned a Bugtraq ID (BID) 36042 to this issue for inclusion in the Security Focus vulnerability database.
This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. CVE-2009-3037 has been assigned to this issue.
9/9/2009 Updated the CVE ID assigned to this issue.