Signature Detail

DNS: Symantec DNS Response DOS

This signature detects attempts to exploit a known vulnerability within multiple Symantec client security products. A successful attack can result in a denial-of-service condition. An attacker can craft a DNS packet that can cause the Symantec security products to enter an infinite loop, allowing an attacker to disable all access to the host running the vulnerable product. The victim will need to reboot the server for the system to be usable again.

Extended Description

Various Symantec Client Firewall products are prone to a remote denial-of-service vulnerability because the applications fail to properly handle DNS response packets.

Affected Products

• Symantec client_firewall 5.0.0 1
• Symantec client_firewall 5.1.1
• Symantec client_security 1.0.0
• Symantec client_security 1.1.0
• Symantec client_security 2.0.0 (SCF 7.1)
• Symantec norton_antispam_2004
• Symantec norton_internet_security_2002
• Symantec norton_internet_security_2002_professional_edition
• Symantec norton_internet_security_2003
• Symantec norton_internet_security_2003_professional_edition
• Symantec norton_internet_security_2004
• Symantec norton_internet_security_2004_professional_edition
• Symantec norton_personal_firewall_2002
• Symantec norton_personal_firewall_2003
• Symantec norton_personal_firewall_2004

References

• BugTraq: 10336
• CVE: CVE-2004-0445