Symantec AntiVirus Scan Engine Web Service Administrative Interface Buffer Overflow Vulnerability

Bugtraq ID:	15001
Class:	Boundary Condition Error
CVE:	CVE-2005-2758
Remote:	Yes
Local:	No
Published:	Oct 03 2005 12:00AM
Updated:	Jul 12 2009 05:06PM
Credit:	Discovery is credited to infamous41md.
Vulnerable:	Symantec AntiVirus Scan Engine for Network Attached Storage 4.3 Symantec AntiVirus Scan Engine for Netapp NetCache 4.0 Symantec AntiVirus Scan Engine for Netapp Filer 4.0 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3 Symantec AntiVirus Scan Engine for Microsoft Portal 4.3 Symantec AntiVirus Scan Engine for Messaging 4.3 Symantec AntiVirus Scan Engine for ISA 4.3 Symantec AntiVirus Scan Engine for ISA 4.0 Symantec AntiVirus Scan Engine for Clearswift 4.3 Symantec AntiVirus Scan Engine for Clearswift 4.0 Symantec AntiVirus Scan Engine for Caching 4.3 Symantec AntiVirus Scan Engine for Bluecoat 4.0 Symantec AntiVirus Scan Engine 4.3 Symantec AntiVirus Scan Engine 4.0
Not Vulnerable:	Symantec AntiVirus Scan Engine for Network Attached Storage 4.3.12 Symantec AntiVirus Scan Engine for Netapp NetCache 4.3.12 Symantec AntiVirus Scan Engine for Netapp Filer 4.3.12 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3.12 Symantec AntiVirus Scan Engine for Messaging 4.3.12 Symantec AntiVirus Scan Engine for ISA 4.3.12 Symantec AntiVirus Scan Engine for Clearswift 4.3.12 Symantec AntiVirus Scan Engine for Caching 4.3.12 Symantec AntiVirus Scan Engine for Bluecoat 4.3.12 Symantec AntiVirus Scan Engine 4.3.12 Symantec AntiVirus Scan Engine 4.1

Symantec AntiVirus Scan Engine Web Service Administrative Interface Buffer Overflow Vulnerability

A buffer overflow vulnerability exists in the Web-based administrative interface of the Symantec Antivirus Scan Engine. This issue is due to improper bound checking of user-supplied data prior to copying it into an insufficiently sized memory buffer.

This vulnerability allows attackers to execute arbitrary machine code in the context of the affected application. This allows remote attackers to gain privileged remote access to computers running the affected application.

Symantec AntiVirus Scan Engine Web Service Administrative Interface Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Symantec AntiVirus Scan Engine Web Service Administrative Interface Buffer Overflow Vulnerability

Solution:
Symantec has released advisory SYM05-017, along with fixes to address this issue. Please see the referenced advisory for further information.

Fixes may be obtained through the Platinum Support Web Site for Platinum customers or through the FileConnect Electronic Software Distribution Web site for all licensed users.

Symantec AntiVirus Scan Engine Web Service Administrative Interface Buffer Overflow Vulnerability

References:

• Security advisory list for Symantec Products (Symantec)
  
• SYM05-017 - Symantec Antivirus Scan Engine: Web Service Administrative Interface (Symantec)
  
• Symantec Homepage (Symantec)
  
• Symantec Scan Engine Home Page (Symantec)
  
• iDEFENSE Security Advisory 10.04.05: Symantec AntiVirus Scan Engine Web Service ("iDEFENSE Labs" )