The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Symantec VERITAS Storage Foundation Administration Service DoS
Vulnerability
------------------------------------------------------------------------
SUMMARY
The
<http://www.symantec.com/enterprise/products/overview.jsp?pcid=1020&pvid=203_1>
VERITAS Storage Foundation is "made up of the Veritas File System, Veritas
Volume Replicator (VVR) products and some other utilities. It allows
virtualization of storage over a variety of platforms, and contains a remote
administration application to configure and monitor the elements of the storage
network". Remote exploitation of an input validation vulnerability in VERITAS
Software Corp.'s Storage Foundation 4.3 Enterprise Administration service could
allow an unauthenticated attacker to consume excessive resources or crash the
service.
DETAILS
Vulnerable Systems:
* VERITAS Storage Foundation for Windows version 4.3.01
The vulnerability specifically exists in the handling of packets delivered
to the VVR Administration service port, TCP/8199. By sending specially
crafted requests to a vulnerable host, attackers are able to control the
size value for memory allocation. In cases where requests are made for
more memory than the system is able to allocate, the service attempts to
write to an invalid pointer, which crashes the service. If allocation
succeeds, the resulting memory will not be released until the connection
is closed. This allows a resource consumption denial of service attack.
Analysis:
Successful exploitation of this vulnerability allows remote attackers to
cause the affected service to terminate. As no checks are made that the
values given make sense, it is possible to cause the service to allocate
large amounts of memory, potentially causing severely degraded system
performance and instability in other processes.
Crashing the administration service, which is restarted after 60 seconds,
would most likely not directly impact the operation of the replication
service itself. However, it likely the resource consumption variation
would prevent the affected system from being usable for the duration of
the attack.
Workaround:
Applying filtering to the affected port, such that only hosts an
administrator uses can access it, will help mitigate exposure to the
vulnerability.
Vendor response:
Symantec has addressed this vulnerability with a software update. For more
information consult their advisory at the following URL:
<http://www.symantec.com/avcenter/security/Content/2007.06.01a.html>
http://www.symantec.com/avcenter/security/Content/2007.06.01a.html
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1593>
CVE-2007-1593
Disclosure Timeline:
10/11/2006 - Initial vendor notification
10/12/2006 - Initial vendor response
06/01/2007 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=539>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=539
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
