Sygate Secure Enterprise Remote Denial Of Service Vulnerability

Bugtraq ID:	10909
Class:	Design Error
CVE:	CVE-2004-0163
Remote:	Yes
Local:	No
Published:	Aug 10 2004 12:00AM
Updated:	Jul 12 2009 06:16AM
Credit:	This vulnerability was discovered and announced by Martin O'Neal of Corsaire Security.
Vulnerable:	Sygate Security Agent 4.0 Sygate Security Agent 3.5 build 2577 Sygate Security Agent 3.5 build 2576 Sygate Security Agent 3.0 Sygate Secure Enterprise 3.5 MR3 Sygate Secure Enterprise 3.5 MR1 Sygate Secure Enterprise 3.5 Sygate Secure Enterprise 3.0
Not Vulnerable:	Sygate Secure Enterprise 3.5 MR3

Sygate Secure Enterprise Remote Denial Of Service Vulnerability

Sygate Secure Enterprise is reported prone to a denial of service vulnerability. The issue is reported to exist due to the weak methods used for communication between the agents and the server.

It is reported that an attacker who can capture a valid Sygate Secure Enterprise protocol session, may replay this session continuously and in doing so exhaust resources on the Sygate Secure Enterprise server.

All versions of Sygate Secure Enterprise prior to 3.5MR3 are reported to be prone to this vulnerability.

Sygate Secure Enterprise Remote Denial Of Service Vulnerability

There is no exploit required.

Sygate Secure Enterprise Remote Denial Of Service Vulnerability

Solution:
It is reported that the vendor has released an upgrade to address this issue. Customers are advised to contact the vendor for details regarding obtaining and applying this upgrade.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sygate Secure Enterprise Remote Denial Of Service Vulnerability

References:

• Sygate Homepage (Sygate)
  
• Corsaire Security Advisory - Sygate Secure Enterprise replay issue ("advisories" )