Symantec Client Firewall Denial of Service Vulnerability

[PA Bear]

<quote>
SYM04-007
April 20, 2004
Symantec Client Firewall Denial of Service Vulnerability
[http://www.symantec.com/avcenter/security/Content/2004.04.20.html]
Revision History
None

Risk Impact
High

Overview
eEye Digital Security notified Symantec Corporation of a severe Denial of Service vulnerability they discovered in the Symantec Client Firewall products for Windows. By properly exploiting this issue, an attacker could render the targeted system inoperable.

Affected Components
Symantec Norton Internet Security and Professional 2003, 2004
Symantec Norton Personal Firewall 2003, 2004
Symantec Client Firewall 5.01, 5.1.1
Symantec Client Security 1.0

Details
eEye Digital Security notified Symantec of a Denial of Service vulnerability they found during product testing against Symantec's client firewall applications. By directing a specifically formatted TCP attack against a target system running a vulnerable Symantec application, an attacker can cause a complete system halt. As a result, the targeted system would require a system reboot to clear the problem.

Symantec Response
Symantec confirmed the vulnerability reported by eEye Digital Security. Symantec product engineers have developed fixes for the issue and released patches for all impacted products through Symantec LiveUpdate and technical support channels.

Clients using Symantec Norton Internet Security and Symantec Norton Personal Firewall who regularly run Symantec LiveUpdate should already be protected against this issue. However, to be sure they are fully protected, customers should run Symantec LiveUpdate manually to ensure all available updates are installed.

a.. Open any installed Symantec product
b.. Click on LiveUpdate in the toolbar
c.. Run LiveUpdate until Symantec LiveUpdate indicated that all installed Symantec products are up-to-date
Clients running Symantec Client Firewall or Symantec Client Security should download and apply patches obtained through their appropriate support channels.

Symantec is not aware of any active attempts against or customer impact from this issue.

Copyright (c) 2004 by Symantec Corp.
</quote>
--
HTH - Please Reply to This Thread

~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

AumHa Forums
http://forum.mvps.org/

Protect Your PC
http://www.microsoft.com/security/protect

 

[Art]

Yet another reason, to skip Norton 2004 and use other programs.
<quote>
SYM04-007
April 20, 2004
Symantec Client Firewall Denial of Service Vulnerability
[http://www.symantec.com/avcenter/security/Content/2004.04.20.html]
Revision History
None

Risk Impact
High

Overview
eEye Digital Security notified Symantec Corporation of a severe Denial of Service vulnerability they discovered in the Symantec Client Firewall products for Windows. By properly exploiting this issue, an attacker could render the targeted system inoperable.

Affected Components
Symantec Norton Internet Security and Professional 2003, 2004
Symantec Norton Personal Firewall 2003, 2004
Symantec Client Firewall 5.01, 5.1.1
Symantec Client Security 1.0

Details
eEye Digital Security notified Symantec of a Denial of Service vulnerability they found during product testing against Symantec's client firewall applications. By directing a specifically formatted TCP attack against a target system running a vulnerable Symantec application, an attacker can cause a complete system halt. As a result, the targeted system would require a system reboot to clear the problem.

Symantec Response
Symantec confirmed the vulnerability reported by eEye Digital Security. Symantec product engineers have developed fixes for the issue and released patches for all impacted products through Symantec LiveUpdate and technical support channels.

Clients using Symantec Norton Internet Security and Symantec Norton Personal Firewall who regularly run Symantec LiveUpdate should already be protected against this issue. However, to be sure they are fully protected, customers should run Symantec LiveUpdate manually to ensure all available updates are installed.

a.. Open any installed Symantec product
b.. Click on LiveUpdate in the toolbar
c.. Run LiveUpdate until Symantec LiveUpdate indicated that all installed Symantec products are up-to-date
Clients running Symantec Client Firewall or Symantec Client Security should download and apply patches obtained through their appropriate support channels.

Symantec is not aware of any active attempts against or customer impact from this issue.

Copyright (c) 2004 by Symantec Corp.
</quote>
--
HTH - Please Reply to This Thread

~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

AumHa Forums
http://forum.mvps.org/

Protect Your PC
http://www.microsoft.com/security/protect

 

[Alun Jones [MS MVP]]

Yet another reason, to skip Norton 2004 and use other programs.

If you dumped every program that you use as soon as you find a vulnerability
in it, you'd be switching and swapping from program to program, and quickly
run out of software to use.

What's more important is not the short-term vulnerabilities, but the
long-term outcomes. Is the developer learning from their previous errors?
Are they quick to fix the problem, or do they spend time denying that it's a
problem?

As you say, though, there are plenty of other reasons to drop Norton.

Alun.
~~~~

[Please don't email posters, if a Usenet response is appropriate.]

 

[Art]

Yes, hopefully companies like Norton and AOL will learn from their
mistakes and make better software. However, I have made the decision
not to use AOL, Norton, and Mcafee because of past poor experiences
and/or too many user complaints. Have a great day!

: In article <[email protected]>, "Art"
: >Yet another reason, to skip Norton 2004 and use other programs.
:
: If you dumped every program that you use as soon as you find a
vulnerability
: in it, you'd be switching and swapping from program to program, and
quickly
: run out of software to use.
:
: What's more important is not the short-term vulnerabilities, but the
: long-term outcomes. Is the developer learning from their previous
errors?
: Are they quick to fix the problem, or do they spend time denying
that it's a
: problem?
:
: As you say, though, there are plenty of other reasons to drop
Norton.
:
: Alun.
: ~~~~
:
: [Please don't email posters, if a Usenet response is appropriate.]
: --
: Texas Imperial Software | Find us at http://www.wftpd.com or email
: 1602 Harvest Moon Place | (e-mail address removed).
: Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP
servers.
: Fax/Voice +1(512)258-9858 | Try our NEW client software, WFTPD
Explorer.

 

[Hugh Candlin]

Yes, hopefully companies like Norton and AOL will learn from their
mistakes and make better software. However, I have made the decision
not to use AOL, Norton, and Mcafee because of past poor experiences
and/or too many user complaints.

Microsoft has duly noted the plethora of Symantec/Norton complaints,
and has taken dead aim on their turf with Longhorn's built-in
and beefed-up virus protection and firewall capabilities.

Another one bites the dust [sooner or later].

Make that later.....

 

[Art]

Do you think Longhorn will have an anti-spyware program included as
well?

:
: > Yes, hopefully companies like Norton and AOL will learn from their
: > mistakes and make better software. However, I have made the
decision
: > not to use AOL, Norton, and Mcafee because of past poor
experiences
: > and/or too many user complaints.
:
: Microsoft has duly noted the plethora of Symantec/Norton complaints,
: and has taken dead aim on their turf with Longhorn's built-in
: and beefed-up virus protection and firewall capabilities.
:
: Another one bites the dust [sooner or later].
:
: Make that later.....
:
:

 

[Hugh Candlin]

Do you think Longhorn will have an anti-spyware program included as
well?

I think so, but I do not know for sure.