Symantec Decomposer Resource Consumption Denial of Service Vulnerability

Bugtraq ID:	27911
Class:	Input Validation Error
CVE:	CVE-2008-0308
Remote:	Yes
Local:	No
Published:	Feb 26 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	iDefense Labs is credited with discovery of this issue.
Vulnerable:	Symantec Scan Engine 5.1.4.24 Symantec Mail Security For Microsoft Exchange 5.0 Symantec Mail Security For Microsoft Exchange 4.6.3 Symantec Mail Security For Microsoft Exchange 4.6 build 97 Symantec Mail Security For Microsoft Exchange 4.6 build 4.6.1.107 Symantec Mail Security For Microsoft Exchange 4.5 build 719 Symantec Mail Security For Microsoft Exchange 4.5 build 4.5.4.743 Symantec Mail Security For Microsoft Exchange 4.5 build 743 Symantec Mail Security For Microsoft Exchange 4.5 build 741 Symantec Mail Security For Microsoft Exchange 4.5 build 736 Symantec Mail Security For Microsoft Exchange 4.5 Symantec Mail Security For Microsoft Exchange 4.1 build 459 Symantec Mail Security For Microsoft Exchange 4.1 build 458 Symantec Mail Security For Microsoft Exchange 4.1 461 Symantec Mail Security For Microsoft Exchange 4.0 build 743 Symantec Mail Security For Microsoft Exchange 4.0 build 741 Symantec Mail Security For Microsoft Exchange 4.0 build 736 Symantec Mail Security For Microsoft Exchange 4.0 build 465 Symantec Mail Security For Microsoft Exchange 4.0 build 463 Symantec Mail Security For Microsoft Exchange 4.0 build 456 Symantec Mail Security For Microsoft Exchange 4.0 Symantec Mail Security For Microsoft Exchange 5.0.4.363 Symantec Mail Security For Microsoft Exchange 5.0.0.024 Symantec Mail Security For Microsoft Exchange 4.6.5.12 Symantec AntiVirus/Filtering for Domino MPE 3.0.12 Symantec AntiVirus/Filtering for Domino MPE 0 Symantec AntiVirus Scan Engine for Network Attached Storage 4.3.12 Symantec AntiVirus Scan Engine for Network Attached Storage 4.3 Symantec AntiVirus Scan Engine for Network Attached Storage 4.3.16.39 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3.12 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3.16.39 Symantec AntiVirus Scan Engine for Messaging 4.3.12 Symantec AntiVirus Scan Engine for Messaging 4.3 Symantec AntiVirus Scan Engine for Messaging 4.3.16.39 Symantec AntiVirus Scan Engine for ISA 4.3.12 Symantec AntiVirus Scan Engine for ISA 4.3 build 4.3.3 Symantec AntiVirus Scan Engine for ISA 4.3 Symantec AntiVirus Scan Engine for ISA 4.0 Symantec AntiVirus Scan Engine for ISA 4.3.16.39 Symantec AntiVirus Scan Engine for Clearswift 4.3.12 Symantec AntiVirus Scan Engine for Clearswift 4.3 Symantec AntiVirus Scan Engine for Clearswift 4.0 Symantec AntiVirus Scan Engine for Clearswift 4.3.16.39 Symantec AntiVirus Scan Engine for Caching 4.3.12 Symantec AntiVirus Scan Engine for Caching 4.3 Symantec AntiVirus Scan Engine for Caching 4.3.16.39 Symantec AntiVirus Scan Engine 5.0.1 Symantec AntiVirus Scan Engine 4.3.17 Symantec AntiVirus Scan Engine 4.3.12 Symantec AntiVirus Scan Engine 4.3.3 Symantec AntiVirus Scan Engine 4.3 build 4.3.8.29 Symantec AntiVirus Scan Engine 4.3 build 4.3.7.27 Symantec AntiVirus Scan Engine 4.3 build 4.3.3 Symantec AntiVirus Scan Engine 4.3 Symantec AntiVirus Scan Engine 4.1.8 Symantec AntiVirus Scan Engine 4.1 Symantec AntiVirus Scan Engine 4.0 Symantec AntiVirus Scan Engine 5.1.4.24 Symantec AntiVirus Scan Engine 5.1 Symantec AntiVirus Scan Engine 5.0
Not Vulnerable:	Symantec Scan Engine 5.1.6.31 Symantec Norton Antivirus for Macintosh 10.9.1 Symantec Norton Antivirus for Macintosh 10.0.1 Symantec Norton Antivirus for Macintosh 9.0.3 Symantec Norton Antivirus for Macintosh 9.0.2 Symantec Norton Antivirus for Macintosh 9.0.1 Symantec Norton Antivirus for Macintosh 9.0 Symantec Norton Antivirus for Macintosh 10.0 Symantec Mail Security For Microsoft Exchange 5.0.6.368 Symantec Mail Security For Microsoft Exchange 4.6.8.120 Symantec Endpoint Protection 11.0 Symantec AntiVirus/Filtering for Domino MPE 3.2.2 Symantec AntiVirus Scan Engine for Network Attached Storage 4.3.18.43 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3.18.43 Symantec AntiVirus Scan Engine for Messaging 4.3.18.43 Symantec AntiVirus Scan Engine for ISA 4.3.18.43 Symantec AntiVirus Scan Engine for Clearswift 4.3.18.43 Symantec AntiVirus Scan Engine for Caching 4.3.18.43 Symantec AntiVirus Scan Engine 4.3.18.43

Symantec Decomposer Resource Consumption Denial of Service Vulnerability

Symantec Decomposer is prone to a denial-of-service vulnerability because it fails to adequately parse certain user-supplied input.

Attackers can exploit this issue to exhaust memory resources and cause denial-of-service conditions.

The following products are affected:
- Symantec Scan Engine 5.1.4.24 and prior
- Symantec AntiVirus Scan Engine 4.3.16.39 and prior
- Symantec AntiVirus Scan Engine for MS ISA 4.3.16.39 and prior
- Symantec AntiVirus Scan Engine for MS SharePoint 4.3.16.39 and prior
- Symantec AntiVirus Scan Engine for Messaging 4.3.16.39 and prior
- Symantec AntiVirus for Network Attached Storage 4.3.16.39 and prior
- Symantec AntiVirus Scan Engine for Clearswift 4.3.16.39 and prior
- Symantec AntiVirus Scan Engine for Caching 4.3.16.39 and prior
- Symantec AntiVirus/Filtering for Domino MPE(AIX, Linux, Solaris) prior to 3.2.2
- Symantec Mail Security for Microsoft Exchange 4.6.5.12 and prior as well as 5.0.4.363 and prior.

Symantec Decomposer Resource Consumption Denial of Service Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symantec Decomposer Resource Consumption Denial of Service Vulnerability

Solution:
Symantec released fixes to address this issue. Please see the references for more information.

Symantec Decomposer Resource Consumption Denial of Service Vulnerability

References:

• Symantec Homepage (Symantec)
  
• iDefense Security Advisory 02.26.08: Symantec Scan Engine 5.1.2 RAR File Denial (iDefense Labs )
  
• SYM08-006 Symantec Decomposer: Multiple Denial of Service Vulnerabilities (Symantec)
  
• Symantec Scan Engine 5.1.2 RAR File Denial of Service Vulnerability (iDefense)