Rigel Kent Security & Advisory Services Inc
		       http://www.rigelksecurity.com 

                       Advisory # RK-001-04

                            Mike Sues
                       September 22, 2004


"Multiple Vulnerabilities in Symantec Enterprise Firewall/Gateway Security
Products"


  Platform	:	Symantec Enterprise Firewall/VPN Appliances
			100, 200, 200R
			Symantec Gateway Security 320
			Symantec Gateway Security 320, 360, 360R
			
  Version	:     100, 200, 200R
				Prior to firmware build 1.63
			320, 360, 360R
				Prior to build 622

  Configuration	:	Default
  	

Abstract:
========

  Three high-risk vulnerabilities have been identified in the Symantec
  Enterprise Firewall products and two in the Gateway products. All are
  remotely exploitable and allow an attacker to perform a denial of service
  attack against the firewall, identify active services in the WAN interface
  and exploit one of these services to collect and alter the firewall or
  gateway's configuration.


Vulnerabilities:
===============


  Issue RK-001-04-01:
	Denial of service caused by a fast UDP port scan
    Severity:
	High
    Description:
	A fast map UDP port scan against all ports (i.e. 1-65535) on the WAN
	interface of the firewall will cause the firewall to lock up and
stop
	responding. Turning the power off and on will reset the firewall.

	The Gateway Security products are not affected by this issue.
    Countermeasure:
	Install firmware build 1.63



  Issue RK-001-04-02:
	Filter bypass on WAN interface
    Severity:
	High
    Description:
	A UDP port scan against the WAN interface of the firewall from a
source
	port of UDP 53 bypasses filter on WAN interface and exposes the
following
	active services,

		tftpd
		snmpd
		isakmp

	All other ports are reported as closed. 
    Countermeasure:
	100, 200, 200R
		Install firmware build 1.63
	320, 360, 360R
		Install firmware build 622



  Issue RK-001-04-03:
	Default read/write community string on SNMP service
    Severity:
	High
    Description:
	The default read/write community string used by the firewall is
public,
	allowing an attacker to collect and alter the firewall's
configuration.
	By combining this with RK-001-04-02, an attacker is able to exploit
this
	against the WAN interface by sending SNMP GET/SET requests whose
source
	port is UDP 53.

	Moreover, the administrative interface for the firewall does not
allow the
	operator to disable the service nor change the community strings. 
    Countermeasure:
	100, 200, 200R
		Install firmware build 1.63
	320, 360, 360R
		Install firmware build 622


Credits:
=======

  Rigel Kent Security & Advisory Services would like to thank Symantec for
  their prompt response and action.