Symantec Intel Alert Management System (CVE-2010-0110) Buffer Overflow Vulnerabilities

Bugtraq ID:	45936
Class:	Boundary Condition Error
CVE:	CVE-2010-0110 CVE-2011-0688
Remote:	Yes
Local:	No
Published:	Jan 26 2011 12:00AM
Updated:	Apr 13 2015 09:05PM
Credit:	Junaid Bohio of Vulnerability Research Team, Telus Security Labs, an anonymous reporter through Tippingpoint�??s Zero Day Initiative(ZDI), and Jorge Lucangeli Obes of CORE Security
Vulnerable:	Symantec Quarantine Server 3.6 Symantec Quarantine Server 3.5 Symantec AntiVirus Corporate Edition 10.1.7 .7000 (MR7) Symantec AntiVirus Corporate Edition 10.1.6 .6010 (MR6-MP1) Symantec AntiVirus Corporate Edition 10.1.5 .5010 (MR5-MP1) Symantec AntiVirus Corporate Edition 10.1.5 .5001 (MR5-PP1) Symantec AntiVirus Corporate Edition 10.1.5 .5000 (MR5) Symantec AntiVirus Corporate Edition 10.1.4 MR4 MP1 - build 4010 Symantec AntiVirus Corporate Edition 10.1.4 .4000 (MR4) Symantec AntiVirus Corporate Edition 10.1.4 Symantec AntiVirus Corporate Edition 10.1 .401 Symantec AntiVirus Corporate Edition 10.1 .400 Symantec AntiVirus Corporate Edition 10.1 .396 Symantec AntiVirus Corporate Edition 10.1 .394 Symantec AntiVirus Corporate Edition 10.0.2 .2021 Symantec AntiVirus Corporate Edition 10.0.2 .2020 Symantec AntiVirus Corporate Edition 10.0.2 .2011 Symantec AntiVirus Corporate Edition 10.0.2 .2010 Symantec AntiVirus Corporate Edition 10.0.2 .2002 Symantec AntiVirus Corporate Edition 10.0.2 .2001 Symantec AntiVirus Corporate Edition 10.0.2 .2000 Symantec AntiVirus Corporate Edition 10.0.1 .1009 (MR1-PP9) Symantec AntiVirus Corporate Edition 10.0.1 .1003 (MR1-PP2) Symantec AntiVirus Corporate Edition 10.0.1 .1001 (MR1-PP1) Symantec AntiVirus Corporate Edition 10.0 Symantec AntiVirus Corporate Edition 10.1.8.8000 Symantec AntiVirus Corporate Edition 10.1.6.6000 Symantec AntiVirus Corporate Edition 10.1.6.600 Symantec AntiVirus Corporate Edition 10.1.4.4010 Symantec AntiVirus Corporate Edition 10.1 MR9 Symantec AntiVirus Corporate Edition 10.1 MR8 Symantec AntiVirus Corporate Edition 10.1 MR7 Symantec AntiVirus Corporate Edition 10.1 MR6 MP1 Symantec AntiVirus Corporate Edition 10.1 MR6 Symantec AntiVirus Corporate Edition 10.1 Symantec AntiVirus Corporate Edition 10.0.1.1008 Symantec AntiVirus Corporate Edition 10.0.1.1007 Symantec AntiVirus Corporate Edition 10.0.1.1000 Symantec AntiVirus Corporate Edition 10.0.0.359 Symantec AntiVirus 10
Not Vulnerable:	Symantec AntiVirus Corporate Edition 10.1 MR10

Symantec Intel Alert Management System (CVE-2010-0110) Buffer Overflow Vulnerabilities

Symantec Intel Alert Management System (AMS2) is prone to multiple remote buffer-overflow vulnerabilities. AMS2 is used in multiple Symantec products including Symantec AntiVirus Corporate Edition Server (SAVCE), Symantec System Center (SSC), and Symantec Quarantine Server.

Attackers can exploit these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Symantec Intel Alert Management System (CVE-2010-0110) Buffer Overflow Vulnerabilities

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Symantec Intel Alert Management System (CVE-2010-0110) Buffer Overflow Vulnerabilities

Solution:
Updates are available. Please contact the vendor for more information.

Symantec Intel Alert Management System (CVE-2010-0110) Buffer Overflow Vulnerabilities

References:

• F-Secure Homepage (F-Secure)
  
• TELUS Security Labs VR - Symantec Alert Management System HNDLRSVC Arbitrary Co (TELUS Security Labs )
  
• Security Advisories Relating to Symantec Products - Symantec Intel Alert Managem (Symantec)
  
• ZDI-11-028 Symantec AMS Intel Alert Service AMSSendAlertAct Remote Code Executio (Zero Day Initiative)