what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Symantec Antivirus Intel Alert Handler Service Denial of Service

Symantec Antivirus Intel Alert Handler Service Denial of Service
Posted Jan 28, 2011
Authored by TELUS Security Labs | Site telussecuritylabs.com

A denial of service vulnerability exists in Symantec Antivirus Intel Alert Handler service. Remote unauthenticated attackers can exploit this vulnerability by sending a malicious packet to the target service.

tags | advisory, remote, denial of service
advisories | CVE-2010-0111
SHA-256 | 9e9991cc21baae425527d30468a81b8551b7dcfe14ef58362a4b2b29ec346383

Symantec Antivirus Intel Alert Handler Service Denial of Service

Change Mirror Download
Symantec Antivirus Intel Alert Handler Service Denial of Service

TSL ID: FSC20101213-06

1. Affected Software

Symantec Antivirus Corporate Edition 10.1.8.8000 and possibly prior
Symantec System Center 10.1.8.8000 and possibly prior

Reference: http://www.symantec.com/business/antivirus-corporate-edition

2. Vulnerability Summary

A denial of service vulnerability exists in Symantec Antivirus Intel Alert Handler service. Remote unauthenticated attackers can exploit this vulnerability by sending a malicious packet to the target service.


3. Vulnerability Analysis

The Alert Management System (AMS) component of Symantec Antivirus Corporate Edition installs an alert handler service, HNDLRSVC, that listens for commands from the AMS server. This service does not perform proper input validation of the command arguments while parsing parameters in the AMSGetPastParamList function. Remote unauthenticated attackers could exploit this vulnerability by sending a crafted packet, with overly long parameter size values, via the MSGSYS.EXE service on port 38292/TCP.


4. Vulnerability Detection

TELUS Security Labs has confirmed the vulnerability in:

Symantec Antivirus Corporate Edition 10.1.8.8000
Symantec System Center 10.1.8.8000

5. Workaround

Disable the AMS service, or update to the non-vulnerable version of Symantec Antivirus 11.x series which does not include the vulnerable AMS component.

6. Vendor Response

Patches have been made available by the vendor to eliminate this vulnerability:

http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_01

7. Disclosure Timeline

2009-10-01 Reported to the vendor
2009-10-20 Vendor response
2011-01-26 Coordinated public disclosure

8. Credits

Junaid Bohio of Vulnerability Research Team, TELUS Security Labs

9. References

CVE: CVE-2010-0111

Vendor: http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_01

http://telussecuritylabs.com/threats/show/FSC20101213-06

10. About TELUS Security Labs

TELUS Security Labs, formerly Assurent Secure Technologies is the leading provider of security research. Our research services include:

* Vulnerability Research
* Malware Research
* Signature Development
* Shellcode Exploit Development
* Application Protocols
* Product Security Testing
* Security Content Development (parsers, reports, alerts)

TELUS Security Labs provides a specialized portfolio of services to assist security product vendors with newly discovered commercial product vulnerabilities and malware attacks. Many of our services are provided on a subscription basis to reduce research costs for our customers. Over 50 of the world's leading security product vendors rely on TELUS Security Labs research.

http://telussecuritylabs.com
Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    0 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close