Symantec Multiple Firewall TCP Options Denial of Service

Release Date:
April 23, 2004

Date Reported:
March 9th, 2004

Severity:
High (Remote Denial of Service)

Vendor:
Symantec

Systems Affected:
Symantec Norton Internet Security 2003
Symantec Norton Internet Security 2004
Symantec Norton Internet Security Professional 2003
Symantec Norton Internet Security Professional 2004
Symantec Norton Personal Firewall 2003
Symantec Norton Personal Firewall 2004 
Symantec Client Firewall 5.01, 5.1.1 
Symantec Client Security 1.0

Description:
eEye Digital Security has discovered a severe denial of service
vulnerability in the Symantec Client Firewall products for Windows. The
vulnerability allows a remote attacker to reliably render a system
inoperative with one single packet. Physical access is required in order
to bring an affected system out of this "frozen" state. This specific
flaw exists within the component that performs low level processing of
TCP packets.

Technical Description:
The vulnerability exists in SYMNDIS.SYS when trying to parse through the
TCP Options in a TCP packet.  When an attacker supplies a single TCP
packet with a TCP option of either SACK (05) or Alternate Checksum Data
(0F) followed by a length of 00, the SYMNDIS.SYS driver enters an
infinite loop and causes the operating system to "freeze up" to the
point where it can no longer be accessed outside of the system itself
nor can any part of the GUI be accessed including keyboard and mouse.
The only way to bring the system back online is to hard boot the system
which requires physical access of the system.  The attacker only needs
to send a single packet to any port on the system regardless of whether
or not the port is open. This flaw is still accessible even if the
firewall or IDS are enabled/disabled. Below is a portion of a TCP SYN
packet (total length of 44 bytes) with a bad SACK TCP option.

Sample Packet:
40 00 57 4B 00 00 01 01 05 00
|___| |___| |___| |_________|
  |	|     |	       |
  |	|     |    TCP Options
  |	|  Urgent Pointer
  |  Checksum
Window Size

The vulnerable code maintains an offset into the TCP option bytes, and
attempts to advance past a variable-length option by adding its length
to the offset.  If the option's length field is zero, then this will
result in an infinite loop and the machine halts completely.

Protection:
Retina Network Security Scanner has been updated to identify this
vulnerability.

Vendor Status:
Symantec has released a patch for this vulnerability. The patch is
available via the Symantec LiveUpdate service.

This vulnerability has been assigned the CVE identifier CAN-2004-0375.

Credit:
Discovery: Karl Lynn

Related Links:
Retina Network Security Scanner - Free 15 Day Trial
http://www.eeye.com/html/Products/Retina/download.html 

Greetings:
The entire eEye family, Kelly H., Geoff and Sarah, Mike M. (Tocks),
Dragon IDS crew, Riley's list of firewall vendors, pie in the sky
charts, SCARFACE : Make Way for The Bad Guy!.

Copyright (c) 1998-2004 eEye Digital Security Permission is hereby
granted for the redistribution of this alert electronically. It is not
to be edited in any way without express consent of eEye. If you wish to
reprint the whole or any part of this alert in any other medium
excluding electronic medium, please email alert@eEye.com for permission.

Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties with regard to this information. In no event shall the
author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.

Feedback
Please send suggestions, updates, and comments to:

eEye Digital Security
http://www.eEye.com 
info@eEye.com