BugTraq
SYM08-015_SFW_SecurityUpdateBypass Aug 14 2008 06:07PM
Mike Prosser (mprosser symantec com)

The attached is a signed version of the security advisory for Symantec Storage Foundation for Windows 5.x that was released today. If we can get the signature to verify, please post to bugtraq

Regards
<<SYM08-015_ SFW_SecurityUpdateBypass.txt>>
----------------------------------------

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Symantec Product Security/Vulnerability Management Team
Symantec takes the security of our products seriously as a responsible
disclosure company. You can view our response policies at
http://www.symantec.com/security.
We will work directly with anyone who believes they have found a security
issue in a Symantec product to validate the problem and coordinate any
response deemed necessary.

Please contact secure (at) symantec (dot) com [email concealed] concerning security issues with Symantec
products.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.6 (Build 6060)

iQEVAwUBSKR0PF1lCKGx9Sr8AQh1/gf/Y+AWFzHBxOGQwoQTAko7kxLQVf7jeC3d
O0jQrpLN7VMgwtu20P9+Zxan0C/pmkCnTu/LnjLJZkSMzZzqX00AXTYV4dM093LH
6ySn5jkB7JbNAUFCjvF/AOUuHu6uCLxoN1lE1uqg+gr9AQ3jwCFY05t+lsmnhNke
gbJQ7uPlsPavu9EtXyXZ/JRbfXZYJLlChyeVm9raUWknUGlEo3M8eNVS2D/WItdv
o5dsydaOjpr8sqC5Tq0FpTqs+PWh5c/qopyTiwbtLcJ99WuANh6K2L1adAxSEWLu
U09m0RVv4RsssLOqVJWgEFNhchch4O/OTG1Z7TCIAGF6rbIbSAW8RQ==
=pdAD
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA256

Symantec Security Advisory

SYM08-015

14 Aug, 2008

Veritas Storage Foundation for Windows Volume Manager Scheduler Service for

Windows Security Update Circumvention

Revision History

None

Severity

Medium

Remote Access Yes, network access required

Local Access No

Authentication Required No

Exploit publicly available No

Overview

It is possible to circumvent the security patch that resolved a previously

identified authentication bypass, remote code execution

vulnerability in the Veritas Storage Foundation for Windows v5.0 Volume

Manager Scheduler Service. Successful exploitation

could result in potential compromise of the targeted system.

Product(s) Affected

Product Version Solution(s)

Veritas Storage Foundation for Windows 5.0, 5.0 RP1a, 5.1

http://entsupport.symantec.com/docs/306386

Note: Only those versions identified above are affected by this issue.

Details

3Com Zero Day Initiative, notified Symantec of a vector that can allow a

malicious user to circumvent the security update for an

authentication bypass vulnerability previously reported in the Veritas

Storage Foundation for Windows Scheduler Service,

http://www.symantec.com/avcenter/security/Content/2007.06.01.html.

The Scheduler Service server, introduced in Veritas Storage Foundation for

Windows v5.0, listens for incoming scheduling messages

from client systems. An attacker with network access who could connect

directly to the Scheduler Service socket could bypass the

security update to the previously reported issue. By properly manipulating

this vector, the attacker has the potential to add

arbitrary commands to the registry that, if properly constructed, would be

executed on the targeted system during normal scheduled runs.

Symantec Response

Symantec engineers have verified and resolved this issue in the Veritas

Storage Foundation for Windows versions and builds identified above.

Symantec recommends customers apply the latest product update available for

their supported product versions to enhance their security

posture and protect against potential security threats of this nature.

Symantec knows of no exploitation of or adverse customer impact from this

issue.

The patches listed above for affected product/version are available from

the following location:

http://entsupport.symantec.com/docs/306386

Best Practices

As part of normal best practices, Symantec strongly recommends:

* Restrict access to administration or management systems to privileged

users.

* Restrict remote access, if required, to trusted/authorized systems only.

* Run under the principle of least privilege where possible to limit the

impact of exploit by threats.

* Keep all operating systems and applications updated with the latest

vendor patches.

* Follow a multi-layered approach to security. Run both firewall and

anti-malware applications, at a minimum, to provide multiple points

of detection and protection to both inbound and outbound threats.

* Deploy network and host-based intrusion detection systems to monitor

network traffic for signs of anomalous or suspicious activity.

This may aid in detection of attacks or malicious activity related to

exploitation of latent vulnerabilities

Credit:

Symantec would like to thank Tenable Security working through 3Com ZDI for

reporting this issue and for providing coordination

while Symantec resolved it.

References:

SecurityFocus, http://www.securityfocus.com, has assigned a Bugtraq ID

(BID), 30596 to this issue for inclusion in the SecurityFocus

vulnerability data base. The BID can be found at

http://www.securityfocus.com/bid/30596

This issue is a candidate for inclusion in the CVE list

(http://cve.mitre.org), which standardizes names for security problems.

A CVE Candidate name has be requested from the Common Vulnerabilities and

Exposures (CVE) initiative for this issue.

This advisory will be revised accordingly upon receipt of the CVE Candidate

name.

- ----------------------------------------------

Copyright (c) 2008 by Symantec Corp.

Permission to redistribute this alert electronically is granted as long as

it is not edited in any way unless authorized by Symantec

Security Response. Reprinting the whole or part of this alert in any medium

other than electronically requires permission from

secure (at) symantec (dot) com. [email concealed]

Disclaimer

The information in the advisory is believed to be accurate at the time of

publishing based on currently available information.

Use of the information constitutes acceptance for use in an AS IS

condition. There are no warranties with regard to this information.

Neither the author nor the publisher accepts any liability for any direct,

indirect, or consequential loss or damage arising from use of,

or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and

secure (at) symantec (dot) com [email concealed] are registered trademarks of Symantec Corp.

and/or affiliated companies in the United States and other countries. All

other registered and unregistered trademarks represented in this

document are the sole property of their respective companies/owners

-----BEGIN PGP SIGNATURE-----

Version: PGP Desktop 9.0.6 (Build 6060)

iQEVAwUBSKRzHF1lCKGx9Sr8AQjTowf+IEePNLsThJ2S3ogsT/lRrTlbMMNl8NC+

yJTodVDxSlkNwaS0JsoFSHfQbv3j/LGoalaeMyWCU3pn/lTAtnMLsJuR+gC2h5i7

2QG4+9yOuOWruV3ofBruSoCb9oDh8ntxllE3WAeN8lumrN1KK45lDi8e6Th70ZpQ

9c81mf32LDdp0lpd1osJco/aXUfu4yGJABOuLJyR1Raqpl8kgBOtOoZHSn4NXr+5

63pi6S02ZECstECEv3D72CjGUygsF+rIfkfQfjvkz59KpbAHm716us+sV7JmXRWM

Ux2EdEeODLC0XIQvKgsUXbFnptqSGIZf6cd4/5NgMhaklUBi+c3dMQ==

=Jo4z

-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus