Entrust LibKMP ISAKMP Library Remote IPsec/ISAKMP Buffer Overflow Vulnerability

Bugtraq ID:	11039
Class:	Boundary Condition Error
CVE:	CVE-2004-0369
Remote:	Yes
Local:	No
Published:	Aug 25 2004 12:00AM
Updated:	Jul 12 2009 06:17AM
Credit:	Discovery of this vulnerability is credited Mark Dowd and Neel Mehta of the ISS X-Force research team.
Vulnerable:	Symantec VelociRaptor 1.5 Symantec Gateway Security 5440 Symantec Gateway Security 5300 Symantec Gateway Security 5200 1.0 Symantec Gateway Security 5110 1.0 Symantec Gateway Security 360R Symantec Enterprise Firewall 7.0.4 Solaris Symantec Enterprise Firewall 7.0.4 NT/2000 Symantec Enterprise Firewall 7.0 Solaris - Sun Solaris 7.0 - Sun Solaris 2.6 Symantec Enterprise Firewall 7.0 NT/2000 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 Entrust LibKMP ISAKMP Library + Symantec Enterprise Firewall 8.0 Solaris + Symantec Enterprise Firewall 8.0 NT/2000 + Symantec Enterprise Firewall 7.0.4 Solaris + Symantec Enterprise Firewall 7.0.4 NT/2000 + Symantec Enterprise Firewall 7.0 Solaris + Symantec Enterprise Firewall 7.0 NT/2000 + Symantec Gateway Security 5300 1.0 + Symantec Gateway Security 5400 2.0 + Symantec VelociRaptor 1.5
Not Vulnerable:

Entrust LibKMP ISAKMP Library Remote IPsec/ISAKMP Buffer Overflow Vulnerability

The Entrust LibKMP ISAKMP library is reported to be affected by a remote buffer overflow vulnerability. Malicious ISAKMP packets may trigger a buffer overrun in the affected library resulting in the corruption of process memory.

It is reported that a remote attacker may exploit this condition to deny service to the Entrust library or to execute arbitrary code in the context of an implementation that uses the library.

Although unconfirmed, it is conjectured that this vulnerability may be related to the vulnerability described in BID 10273, as Checkpoint VPN-1 may use the affected library.

Entrust LibKMP ISAKMP Library Remote IPsec/ISAKMP Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Entrust LibKMP ISAKMP Library Remote IPsec/ISAKMP Buffer Overflow Vulnerability

Solution:
Symantec has released an advisory (SYM04-012) and hotfixes dealing with this issue. Customers are advised to refer to the referenced advisory for further information pertaining to obtaining and applying appropriate hotfixes.

Entrust has released an advisory (E04-002) dealing with this issue. Customers are advised to refer to the referenced advisory for further information pertaining to obtaining and applying appropriate fixes. It should be noted that a customer login is required to access the Entrust advisory.


Symantec Gateway Security 5300

• Symantec entrust-sgs10-3des.tgz
  ftp://ftp.symantec.com/public/updates/entrust-sgs10-3des.tgz

Symantec Gateway Security 5200 1.0

• Symantec entrust-sgs10-3des.tgz
  ftp://ftp.symantec.com/public/updates/entrust-sgs10-3des.tgz

Symantec Gateway Security 5110 1.0

• Symantec entrust-sgs10-3des.tgz
  ftp://ftp.symantec.com/public/updates/entrust-sgs10-3des.tgz

Symantec VelociRaptor 1.5

• Symantec entrust-vr15-3des.tgz
  ftp://ftp.symantec.com/public/updates/entrust-vr15-3des.tgz

Symantec Enterprise Firewall 7.0 NT/2000

• Symantec entrust-704w-3des.exe
  Domestic Hotfix
  ftp://ftp.symantec.com/public/updates/entrust-704w-3des.exe


• Symantec entrust-704w-des.exe
  International Hotfix
  ftp://ftp.symantec.com/public/updates/entrust-704w-des.exe

Symantec Enterprise Firewall 7.0 Solaris

• Symantec entrust-704s-3des.tar.Z
  Domestic Hotfix
  ftp://ftp.symantec.com/public/updates/entrust-704s-3des.tar.Z


• Symantec entrust-704s-des.tar.Z
  International Hotfix
  ftp://ftp.symantec.com/public/updates/entrust-704s-des.tar.Z

Symantec Enterprise Firewall 7.0.4 Solaris

• Symantec entrust-704s-3des.tar.Z
  Domestic Hotfix
  ftp://ftp.symantec.com/public/updates/entrust-704s-3des.tar.Z


• Symantec entrust-704s-des.tar.Z
  International Hotfix
  ftp://ftp.symantec.com/public/updates/entrust-704s-des.tar.Z

Symantec Enterprise Firewall 7.0.4 NT/2000

• Symantec entrust-704w-3des.exe
  Domestic Hotfix
  ftp://ftp.symantec.com/public/updates/entrust-704w-3des.exe


• Symantec entrust-704w-des.exe
  International Hotfix
  ftp://ftp.symantec.com/public/updates/entrust-704w-des.exe

Entrust LibKMP ISAKMP Library Remote IPsec/ISAKMP Buffer Overflow Vulnerability

References:

• Entrust LibKmp Library Buffer Overflow (Internet Security Systems)
  
• Entrust Security Bulletin E04-002 (Entrust)
  
• Symantec Clientless VPN Gateway 4400 Series Homepage (Symantec)
  
• Symantec Enterprise Firewall 7.0 for NT/2000 Hotfix: SG7004-20040715-00 (Symantec)
  
• Symantec Enterprise Firewall 7.0 for Solaris Hotfix: SG7004-20040715-00 (Symantec)
  
• Symantec Enterprise Firewall 7.0.4 for Solaris Hotfix: SG7004-20040715-00 (Symantec)
  
• Symantec Enterprise Firewall 7.0.4 for WindowsNT/2000 Hotfix: SG7004-20040715-00 (Symantec)
  
• Symantec Enterprise Firewall Product Homepage (Symantec)
  
• Symantec Gateway Security 1.0 Hotfix: SG7004-20040715-00 - Entrust updates (Symantec)
  
• Symantec Gateway Security 2.0 Hotfix: SG7004-20040715-00 - Entrust updates (Symantec)
  
• Symantec IPsec/ISAKMP VPN Buffer Overflow (Symantec)