Multiple Symantec Products Intel Alert Originator Service Stack Overflow Vulnerability
BID:34672
Info
Multiple Symantec Products Intel Alert Originator Service Stack Overflow Vulnerability
| Bugtraq ID: | 34672 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2009-1430 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 28 2009 12:00AM |
| Updated: | Aug 31 2009 05:42PM |
| Credit: | Sebastian Apelt, working through the Zero Day Initiative (ZDI) |
| Vulnerable: |
Symantec Endpoint Protection 11.0.2020 .56 (MR2-MP2) Symantec Endpoint Protection 11.0.2010 .25 (MR2-MP1) Symantec Endpoint Protection 11.0.2001 .10 (MR2-PP1) Symantec Endpoint Protection 11.0.2000 .1567 (MR2) Symantec Endpoint Protection 11.0.1005 .1428 (MR1-PP5) Symantec Endpoint Protection 11.0.1002 .1378 (MR1-PP2) Symantec Endpoint Protection 11.0.1000 .1375 (MR1) Symantec Endpoint Protection 11.0.781 .1287 (STM-PP1) Symantec Endpoint Protection 11.0.780 .1109 (STM) Symantec Client Security 3.1.7 .7000 (MR7) Symantec Client Security 3.1.6 .6010 (MR6-MP1) Symantec Client Security 3.1.5 .5010 (MR5-MP1) Symantec Client Security 3.1.5 .5001 (MR5-PP1) Symantec Client Security 3.1.5 .5000 (MR5) Symantec Client Security 3.1.4 MR4 MP1 - build 4010 Symantec Client Security 3.1.4 .4000 (MR4) Symantec Client Security 3.1 .401 Symantec Client Security 3.1 .400 Symantec Client Security 3.1 .396 Symantec Client Security 3.0.2 .2021 Symantec Client Security 3.0.2 .2020 Symantec Client Security 3.0.2 .2011 Symantec Client Security 3.0.2 .2010 Symantec Client Security 3.0.2 .2002 Symantec Client Security 3.0.2 .2001 Symantec Client Security 3.0.2 .2000 Symantec Client Security 3.0.1 .1009 (MR1-PP9) Symantec Client Security 3.0.1 .1003 (MR1-PP2) Symantec Client Security 3.0 Symantec Client Security 2.0.6 MR6 MP1 - build 1100 Symantec Client Security 2.0.6 MR6 Symantec Client Security 2.0.6 .1000 (MR6) Symantec Client Security 2.0.5 build 1100 Symantec Client Security 2.0.5 .1001 (MR5-PP1) Symantec Client Security 2.0.5 .1000 (MR5) Symantec Client Security 2.0.4 MR4 build 1000 Symantec Client Security 2.0.4 Symantec Client Security 2.0.3 .1100 (MR3-MP1) Symantec Client Security 2.0.3 .1000 (MR3) Symantec Client Security 2.0.2 .1000 (MR2) Symantec Client Security 2.0.1 .1100 (MR1-MP1) Symantec Client Security 2.0.1 .1001 (MR1-PP1) Symantec Client Security 2.0.1 .1000 (MR1) Symantec Client Security 2.0 .338 (STM) Symantec Client Security 2.0 .1400 (STM-PP2) Symantec Client Security 2.0 .1300 (STM-PP1) Symantec Client Security 3.1.6.6000 Symantec Client Security 3.1.6.6000 Symantec Client Security 3.1 MR7 Symantec Client Security 3.1 MR6 MP1 Symantec Client Security 3.1 MR6 Symantec Client Security 3.1 Symantec Client Security 3.0.1.1008 Symantec Client Security 3.0.1.1007 Symantec Client Security 3.0.1.1001 Symantec Client Security 3.0.1.1000 Symantec Client Security 3.0.0.359 Symantec AntiVirus Corporate Edition 10.2.1 .1000 (MR1) Symantec AntiVirus Corporate Edition 10.2 .313 (STM-PP1) Symantec AntiVirus Corporate Edition 10.2 .298 (STM 64-bit) Symantec AntiVirus Corporate Edition 10.2 .276 (STM 32-bit) Symantec AntiVirus Corporate Edition 10.1.7 .7000 (MR7) Symantec AntiVirus Corporate Edition 10.1.6 .6010 (MR6-MP1) Symantec AntiVirus Corporate Edition 10.1.5 .5010 (MR5-MP1) Symantec AntiVirus Corporate Edition 10.1.5 .5001 (MR5-PP1) Symantec AntiVirus Corporate Edition 10.1.5 .5000 (MR5) Symantec AntiVirus Corporate Edition 10.1.4 MR4 MP1 - build 4010 Symantec AntiVirus Corporate Edition 10.1.4 .4000 (MR4) Symantec AntiVirus Corporate Edition 10.1.4 Symantec AntiVirus Corporate Edition 10.1 .401 Symantec AntiVirus Corporate Edition 10.1 .400 Symantec AntiVirus Corporate Edition 10.1 .396 Symantec AntiVirus Corporate Edition 10.1 .394 Symantec AntiVirus Corporate Edition 10.0.2 .2021 Symantec AntiVirus Corporate Edition 10.0.2 .2020 Symantec AntiVirus Corporate Edition 10.0.2 .2011 Symantec AntiVirus Corporate Edition 10.0.2 .2010 Symantec AntiVirus Corporate Edition 10.0.2 .2010 Symantec AntiVirus Corporate Edition 10.0.2 .2002 Symantec AntiVirus Corporate Edition 10.0.2 .2001 Symantec AntiVirus Corporate Edition 10.0.2 .2000 Symantec AntiVirus Corporate Edition 10.0.1 .1009 (MR1-PP9) Symantec AntiVirus Corporate Edition 10.0.1 .1003 (MR1-PP2) Symantec AntiVirus Corporate Edition 10.0.1 .1001 (MR1-PP1) Symantec AntiVirus Corporate Edition 10.0 Symantec AntiVirus Corporate Edition 9.0.6 MR6 MP1 - build 1100 Symantec AntiVirus Corporate Edition 9.0.6 .1000 (MR6) Symantec AntiVirus Corporate Edition 9.0.5 .1100 Symantec AntiVirus Corporate Edition 9.0.5 .1001 (MR5-PP1) Symantec AntiVirus Corporate Edition 9.0.5 .1000 (MR5) Symantec AntiVirus Corporate Edition 9.0.5 Symantec AntiVirus Corporate Edition 9.0.4 MR4 build 1000 Symantec AntiVirus Corporate Edition 9.0.4 Symantec AntiVirus Corporate Edition 9.0.3 .1100 (MR3-MP1) Symantec AntiVirus Corporate Edition 9.0.3 .1000 Symantec AntiVirus Corporate Edition 9.0.2 .1000 Symantec AntiVirus Corporate Edition 9.0.1 .1100 (MR1-MP1) Symantec AntiVirus Corporate Edition 9.0.1 .1001 (MR1-PP1) Symantec AntiVirus Corporate Edition 9.0.1 .1000 (MR1) Symantec AntiVirus Corporate Edition 9.0 .1400 (STM-PP2) Symantec AntiVirus Corporate Edition 9.0 .1300 (STM-PP1) Symantec AntiVirus Corporate Edition 9.0 .0.338 Symantec AntiVirus Corporate Edition 9.0 Symantec AntiVirus Corporate Edition 9.0.6.1000 Symantec AntiVirus Corporate Edition 9 MR6 MP1 Symantec AntiVirus Corporate Edition 10.2 MR1 Symantec AntiVirus Corporate Edition 10.2 Symantec AntiVirus Corporate Edition 10.1.6.6000 Symantec AntiVirus Corporate Edition 10.1.4.4010 Symantec AntiVirus Corporate Edition 10.1 MR7 Symantec AntiVirus Corporate Edition 10.1 MR6 MP1 Symantec AntiVirus Corporate Edition 10.1 MR6 Symantec AntiVirus Corporate Edition 10.1 Symantec AntiVirus Corporate Edition 10.0.2.2000 Symantec AntiVirus Corporate Edition 10.0.1.1008 Symantec AntiVirus Corporate Edition 10.0.1.1007 Symantec AntiVirus Corporate Edition 10.0.1.1000 Symantec AntiVirus Corporate Edition 10.0.0.359 |
| Not Vulnerable: |
Symantec Endpoint Protection 11.0.4010 .26 (MR4-MP1a) Symantec Endpoint Protection 11.0.4010 .19 (MR4-MP1) Symantec Endpoint Protection 11.0.4000 .2295 (MR4) Symantec Endpoint Protection 11.0.3001 .2224 (MR3) Symantec Endpoint Protection 11.0 MR3 Symantec Client Security 3.1 MR8 Symantec Client Security 2.0 MR7 Symantec AntiVirus Corporate Edition 9.0 MR7 Symantec AntiVirus Corporate Edition 10.2 MR2 Symantec AntiVirus Corporate Edition 10.1 MR8 |
Discussion
Multiple Symantec Products Intel Alert Originator Service Stack Overflow Vulnerability
Multiple Symantec products are prone to a stack-based buffer-overflow vulnerability.
Successfully exploiting this issue will allow an attacker to execute arbitrary code with SYSTEM-level privileges, completely compromising affected computers. Failed exploit attempts will result in a denial-of-service condition.
Multiple Symantec products are prone to a stack-based buffer-overflow vulnerability.
Successfully exploiting this issue will allow an attacker to execute arbitrary code with SYSTEM-level privileges, completely compromising affected computers. Failed exploit attempts will result in a denial-of-service condition.
Exploit / POC
Multiple Symantec Products Intel Alert Originator Service Stack Overflow Vulnerability
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Multiple Symantec Products Intel Alert Originator Service Stack Overflow Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Solution:
The vendor has released an advisory and updates. Please see the references for details.
References
Multiple Symantec Products Intel Alert Originator Service Stack Overflow Vulnerability
References:
References: