7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
Summary
Symantec Network and Information Security (NIS) products using affected versions of OpenSSL may be susceptible to two vulnerabilities. A remote attacker may be able to cause denial of service through application crashes. An application may successfully validate an invalid X.509 certificate chain, which may result in improper authentication or man-in-the-middle (MITM) attacks.
Affected Product(s)
The following products and product versions are vulnerable to the CVEs listed. If a CVE is not listed, the product or version is not known to be vulnerable to it.
CVE |Supported Version(s)|Remediation
CVE-2021-3449 | 7.2 | Remediation is not available at this time.
7.3 | Upgrade to 7.3.4.1.
CVE |Supported Version(s)|Remediation
CVE-2021-3449 | 7.2 | Remediation is not available at this time.
7.3 | Upgrade to 7.3.4.1.
Additional Product Information
The following products are not vulnerable:**
AuthConnector
BCAAA
Content Analysis (CA)
HSM Agent
General Auth Connector Login Application
Management Center (MC)
PacketShaper (PS) S-Series
PolicyCenter (PC) S-Series
Reporter
Security Analytics
SSL Visibility (SSLV)
****Symantec Messaging Gateway (SMG) **Web Isolation (WI)
WSS Agent WSS Mobile Agent
Issue Details
Severity / CVSS v3.1: | Medium / 5.3 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) References:| NVD: CVE-2021-3449 Impact:| Security control bypass Description: | A flaw in TLS v1.2 renegotiation handling allows a remote attacker to send crafted renegotiation requests and cause denial of service through application crashes.
Severity / CVSS v3.1: | High / 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) References:| NVD: CVE-2021-3450 Impact:| Denial of service Description: | A flaw in certificate validation handling may cause an application to ignore CA certificate check results and successfully validate an invalid certificate chain. This may result in improper authentication of remote application or man-in-the-middle (MITM) attacks.
References
OpenSSL Security Advisory [25 March 2021] - <https://www.openssl.org/news/secadv/20210325.txt>
Revisions
2021-09-03 WI 1.14 is not vulnerable.
2021-08-27 A fix for CVE-2021-3449 in ASG 7.3 and ProxySG 7.3 is available in 7.3.4.1. WI 1.15 is not vulnerable. WI 1.14 is under investigation.
2021-04-22 ASG 6.7 and ProxySG 6.7 are not vulnerable.
2021-04-07 initial public release
CPE | Name | Operator | Version |
---|---|---|---|
advanced secure gateway (asg) | eq | 7 | |
advanced secure gateway (asg) | eq | 7 | |
proxysg | eq | 7 | |
proxysg | eq | 7 |
7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N