The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Sygate Enforcer Discovery Packet DoS
------------------------------------------------------------------------
SUMMARY
<http://www.sygate.com/products/universal_enforcement.htm> Sygate
Enforcers are described as "network gateway devices that enforce host
integrity at network access points". Architecturally they function as an
authenticated, packet-filtering firewall device. The Enforcer interacts
with the Sygate Security Agent (SAA [the personal firewall component])
product and limits access to protected networks/hosts to authenticated
clients that comply with a predefined policy.
In practice, the Enforcer device uses a number of proprietary protocol
exchanges to communicate with other Enforcers and also the SAA product. By
sending a packet containing a malformed payload to the Enforcer, the host
service can be forced to stop responding.
DETAILS
Vulnerable Systems:
* Sygate Enforcer version 4.0 and prior
The Sygate Enforcer product sends a discovery packet at one-second
intervals on all interfaces that have IP bound to them. The packet is a
UDP datagram, from source port 39999 to destination port 39999, and is
sent to the local subnet broadcast address.
If this packet is malformed and replayed to the Enforcer, it will cause
the Enforcer service to stop unexpectedly, without generating an entry
within the product's audit trail.
It is worth noting that the packet that is replayed does not need to be
sent to the local subnet broadcast address, and can be happily sent to any
valid Unicast address associated with the Enforcer. This means that the
attacker does not need to be local to the Enforcer to exploit this issue.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0931>
CAN-2003-0931
ADDITIONAL INFORMATION
The information has been provided by <mailto:martin.oneal@corsaire.com>
Martin O'Neal.
The original article can be found at:
<http://www.corsaire.com/advisories/c031120-001.txt>
http://www.corsaire.com/advisories/c031120-001.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
