Symantec Norton Internet Security ICMP Packet Flood Denial Of Service Vulnerability

Bugtraq ID:	6598
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	Yes
Published:	Jan 13 2003 12:00AM
Updated:	Jan 13 2003 12:00AM
Credit:	Discovery of this issue is credited to Pavel P. <[email protected]>.
Vulnerable:	Symantec Norton Personal Firewall 2003 Symantec Norton Internet Security 2003 Professional Edition Symantec Norton Internet Security 2003
Not Vulnerable:

Symantec Norton Internet Security ICMP Packet Flood Denial Of Service Vulnerability

Symantec Norton Internet Security 2003 is reported to be prone to a denial of service condition.

It is possible to trigger this condition by sending an excessive (approximately 65500 or more) number of ICMP packets to a host running Norton Internet Security. This may cause a denial of service and possible system instability.

For this issue to be present remotely, the software must be configured to allow ICMP packets and the firewall must be enabled. Otherwise, it is possible to trigger this condition locally.

It is not known if earlier versions of the software are also affected by this vulnerability.

Symantec Norton Internet Security ICMP Packet Flood Denial Of Service Vulnerability

There is no exploit required. The following example was provided:

ping targetip -l 65500

Symantec Norton Internet Security ICMP Packet Flood Denial Of Service Vulnerability

Solution:
Upgrades are available via LiveUpdate.

Symantec Norton Internet Security ICMP Packet Flood Denial Of Service Vulnerability

References:

• Symantec Norton Internet Security ICMP Packet Flood Denial Of Service (Symantec)
  
• NIS 2003 (Pavel P. )