[NT] Symantec Ghost Multiple DoS Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Symantec Ghost Multiple DoS Vulnerabilities
------------------------------------------------------------------------

SUMMARY

Symantec
<http://www.symantec.com/enterprise/products/overview.jsp?pcid=1025&pvid=865_1 > Ghost Solution Suite is "an enterprise disk imaging software that allows administrators to remotely back-up and restore client computers from a central server".

Remote exploitation of multiple denial of service vulnerabilities in
Symantec Corp.'s Ghost allow remote attackers to crash the Ghost service.

DETAILS

Vulnerable Systems:
* Symantec Ghost version 8.0.992 (as supplied with Ghost Solution Suite).

These vulnerabilities affect both the client and server daemons due to
what looks like a shared communications library. The daemons listen on UDP
ports 1346, and 1347 respectively.

By sending a malformed UDP-based request to either service, an attacker
can cause the service to crash due to an invalid memory reference. This
condition can be caused by any of several unique requests. In each case,
the particular cause for the access violation varies.

Exploitation allows remote attackers to crash the Ghost client or server
applications.

The UDP packets can be multicast to an entire sub-net taking down all
processes with one packet. Authentication is not required. Since it is a
UDP packet, it is trivial for the attacker to mask the origin of the
attack by forging the source IP address in the packet header.

By default, the Ghost services are not set to auto restart in the event of
failure. Regardless, exploitation would likely abort any Ghost procedures
currently in progress when the crash occurred.

Workaround:
Employing firewalls to limit access to the client and server daemons can
help prevent exploitation of these vulnerabilities. However, attackers
could potentially bypass firewall rules by forging the origin of attack.

Vendor Status:
Symantec has addressed this vulnerability with a software update. For more
information consult their advisory at the following URL.
<http://www.symantec.com/avcenter/security/Content/2007.06.05b.html>

http://www.symantec.com/avcenter/security/Content/2007.06.05b.html

Disclosure Timeline:
* 12/13/2006 - Initial vendor notification
* 12/13/2006 - Initial vendor response
* 06/05/2007 - Coordinated public disclosure

ADDITIONAL INFORMATION

The information has been provided by iDefense.
The original article can be found at:

<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=540>

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=540

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.