Symantec Antivirus ''hndlrsvc.exe' Denial of Service Vulnerability

Bugtraq ID:	45368
Class:	Input Validation Error
CVE:	CVE-2010-3268
Remote:	Yes
Local:	No
Published:	Dec 13 2010 12:00AM
Updated:	Dec 13 2010 12:00AM
Credit:	Nahuel Riva from Core Security Technologies
Vulnerable:	Symantec AntiVirus Corporate Edition 10.1.4.4010
Not Vulnerable:

Symantec Antivirus ''hndlrsvc.exe' Denial of Service Vulnerability

Symantec Antivirus is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

Symantec Antivirus Corporate Edition 10.1.4.4010 is vulnerable; other versions may also be affected.

Symantec Antivirus ''hndlrsvc.exe' Denial of Service Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Symantec Antivirus ''hndlrsvc.exe' Denial of Service Vulnerability

Solution:
Reports indicate that the affected component is not present in 11.x versions of Symantec Endpoint Protection. Users are advised to upgrade if possible.

Symantec Antivirus ''hndlrsvc.exe' Denial of Service Vulnerability

References:

• [CORE-2010-0728] Symantec Intel Handler Service Remote Denial-of-Service (Core Security Technologies)
  
• Symantec Homepage (Symantec)