Symantec Ghost Solution Suite ARP Spoofing Authentication Bypass Vulnerability

Bugtraq ID:	27644
Class:	Access Validation Error
CVE:	CVE-2008-0640
Remote:	Yes
Local:	No
Published:	Feb 07 2008 12:00AM
Updated:	Mar 13 2008 03:11PM
Credit:	Nicolas Pouvesle of Tenable Security is credited with the discovery of this vulnerability.
Vulnerable:	Symantec Ghost Solutions Suite (SGSS) 2.0.1 Symantec Ghost Solutions Suite (SGSS) 2.0 Symantec Ghost Solutions Suite (SGSS) 1.1
Not Vulnerable:	Symantec Ghost Solutions Suite (SGSS) 2.0.2 Symantec Ghost Solutions Suite (SGSS) 1.1 patch 2

Symantec Ghost Solution Suite ARP Spoofing Authentication Bypass Vulnerability

Symantec Ghost Solution Suite is prone to an authentication-bypass vulnerability.

Attackers can exploit this issue by sending a spoofed ARP packet to the affected client.

Successfully exploiting this issue will allow attackers to impersonate the Symantec Ghost Solution Suite server and execute arbitrary commands on the client with SYSTEM-level privileges, facilitating the complete compromise of affected computers.

This issue affects Symantec Ghost Solution Suite 1.1, 2.0.0, and 2.0.1.

NOTE: Users who do not use the Ghost Console or the Ghost Management Agent are not affected.

Symantec Ghost Solution Suite ARP Spoofing Authentication Bypass Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symantec Ghost Solution Suite ARP Spoofing Authentication Bypass Vulnerability

Solution:
Symantec released updates and an advisory to address this issue. Please see the references for more information.


Symantec Ghost Solutions Suite (SGSS) 1.1

• Symantec GSS1.1.b1355.Update.exe
  ftp://ftp.symantec.com/public/english_us_canada/products/symantec_ghos t_solution_suite/1.1/updates/GSS1.1.b1355.Update.exe

Symantec Ghost Solution Suite ARP Spoofing Authentication Bypass Vulnerability

References:

• Symantec Ghost Solution Suite Homepage (Symantec)
  
• SYM08-003: Symantec Ghost Solution Suite: server authentication vulnerability (Symantec)