Rigel Kent Security & Advisory Services Inc
           http://www.rigelksecurity.com

                       Advisory # RK-001-04

                            Mike Sues
                       September 22, 2004


"Multiple Vulnerabilities in Symantec Enterprise Firewall/Gateway Security
Products"


  Platform  :  Symantec Enterprise Firewall/VPN Appliances
      100, 200, 200R
      Symantec Gateway Security 320
      Symantec Gateway Security 320, 360, 360R
      
  Version  :     100, 200, 200R
        Prior to firmware build 1.63
      320, 360, 360R
        Prior to build 622

  Configuration  :  Default
    

Abstract:
========

  Three high-risk vulnerabilities have been identified in the Symantec
  Enterprise Firewall products and two in the Gateway products. All are
  remotely exploitable and allow an attacker to perform a denial of service
  attack against the firewall, identify active services in the WAN interface
  and exploit one of these services to collect and alter the firewall or
  gateway's configuration.


Vulnerabilities:
===============


  Issue RK-001-04-01:
  Denial of service caused by a fast UDP port scan
    Severity:
  High
    Description:
  A fast map UDP port scan against all ports (i.e. 1-65535) on the WAN
  interface of the firewall will cause the firewall to lock up and
stop
  responding. Turning the power off and on will reset the firewall.

  The Gateway Security products are not affected by this issue.
    Countermeasure:
  Install firmware build 1.63



  Issue RK-001-04-02:
  Filter bypass on WAN interface
    Severity:
  High
    Description:
  A UDP port scan against the WAN interface of the firewall from a
source
  port of UDP 53 bypasses filter on WAN interface and exposes the
following
  active services,

    tftpd
    snmpd
    isakmp

  All other ports are reported as closed. 
    Countermeasure:
  100, 200, 200R
    Install firmware build 1.63
  320, 360, 360R
    Install firmware build 622



  Issue RK-001-04-03:
  Default read/write community string on SNMP service
    Severity:
  High
    Description:
  The default read/write community string used by the firewall is
public,
  allowing an attacker to collect and alter the firewall's
configuration.
  By combining this with RK-001-04-02, an attacker is able to exploit
this
  against the WAN interface by sending SNMP GET/SET requests whose
source
  port is UDP 53.

  Moreover, the administrative interface for the firewall does not
allow the
  operator to disable the service nor change the community strings. 
    Countermeasure:
  100, 200, 200R
    Install firmware build 1.63
  320, 360, 360R
    Install firmware build 622


Credits:
=======

  Rigel Kent Security & Advisory Services would like to thank Symantec for
  their prompt response and action.