__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN VERITAS Storage Exec DCOM Server Buffer Overflows [Symantec SYM05-014] September 21, 2005 17:00 GMT Number P-309 ______________________________________________________________________________ PROBLEM: Multiple VERITAS Storage Exec DCOM server components have been identified as susceptible to buffer overflows through calls to associated ActiveX controls. PLATFORM: Storage Exec 5.3 rev. 2190R StorageCentral 5.2 rev. 322 DAMAGE: If properly exploited, this vulnerability could allow execution of remotely downloaded code on the system with privileges of the logged on user. Exploitation may result in a system crash, or potentially lead to access to the local system with privileges of the authenticated user. SOLUTION: Apply all current hotfixes. ______________________________________________________________________________ VULNERABILITY The risk is LOW. An authenticated user would have to visit a ASSESSMENT: hostile web site where the malicious code could be successfully executed, or download it from a source and run it on the victim's system. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/p-309.shtml ORIGINAL BULLETIN: http://securityresponse.symantec.com/avcenter/security/Content/2005.09.19.html CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= ______________________________________________________________________________ [***** Start Symantec SYM05-014 *****] SYM05-014 September 19, 2005 VERITAS Storage Exec DCOM Server Buffer Overflows Revision History None Risk Impact Medium Remote Access Yes, highly dependent on user involvement Local Access Yes Authentication Required No, runs with authenticated user permissions Exploit publicly available No Overview Multiple VERITAS Storage Exec DCOM server components have been identified as susceptible to buffer overflows through calls to associated ActiveX controls. If properly exploited, this vulnerability could allow execution of remotely downloaded code on the system with privileges of the logged on user. Exploitation may result in a system crash, or potentially lead to access to the local system with privileges of the authenticated user. Successful exploitation is highly dependent on user involvement for malicious code to gain initial access to the system. Affected Supported Products Product Version Build Solution Storage Exec 5.3 rev. 2190R Hotfix 9 StorageCentral 5.2 rev. 322 Hotfix Q323003.ism Hot Fix 2 Legacy versions may also be affected. Customers running earlier legacy versions should upgrade to the latest version indicated above and apply all current hotfixes. Details NGS Research identified multiple DCOM servers in VERITAS Storage Exec that are susceptible to stack and heap overflows as they fail to properly validate/parse external input. The buffer overflows in the DCOM servers can be successfully initiated by calls to associated ActiveX controls. To successfully launch this type of attack, the authenticated user would have had to either visit a hostile web site or be enticed to visit a hostile location where the malicious code could be successfully executed or downloaded to the local system. Or, the user would need to download an html email containing malicious code that could be successfully run on the system. Exploiting this issue could result in a system crash or, if successful, could potentially result in access to the local system with authenticated user privileges. Symantec Response Symantec engineers have verified these issues and made security upgrades available for VERITAS Storage Exec 5.3 and StorageCentral 5.2. Symantec recommends customers immediately apply the latest hotfix update for their supported product versions to protect against these types of threats. In a normal network deployment, VERITAS Storage Exec or Storage Central would be restricted to administrative positions, which would reduce target availability. Product specific fixes are available from the following Support locations VERITAS Storage Exec 5.3 rev 2190R - Hotfix 9 http://support.veritas.com/docs/277566 VERITAS StorageCentral 5.2 rev 322 - Hotfix Q323003.ism Hot Fix 2 http://support.veritas.com/docs/277567 Symantec is not aware of any exploit of or adverse customer impact from these issues. As normal best practices, Symantec strongly recommends: * Restricting access to administration or management systems to privileged users only with additional restricted access to the physical host system(s) if possible. * Running under the principle of least privilege where possible to limit the impact of exploit by threats such as this. * Keeping all operating systems and applications updated with the latest vendor patches. * Following a multi-layered approach to security. Run both firewall and antivirus applications, at a minimum to provide multiple points of detection and protection to both inbound and outbound threats. * Being cautious of mysterious attachments and executables delivered via email and cautious of visiting unknown/untrusted websites or executing unknown URL links. * Not opening unidentified attachments or executables from unknown sources or that you didn't request or were unaware of. Always err on the side of caution. Even if the sender is known, the source address may be spoofed. * If in doubt, contact the sender to confirm they sent it and why before opening the attachment. If still in doubt, delete the attachment without opening it. CVE A CVE candidate number will be requested from The Common Vulnerabilities and Exposures (CVE) initiative. This advisory will be revised as required once the CVE candidate number has been assigned. This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. Credit Symantec would like to thank NGS Research’s Mark Litchfield, for identifying and reporting this issue and providing coordination while Symantec resolved the issue. Symantec takes the security and proper functionality of its products very seriously. As founding members of the Organization for Internet Safety (OISafety), Symantec follows the principles of responsible disclosure. Symantec also subscribes to the vulnerability guidelines outlined by the National Infrastructure Advisory Council (NIAC). Please contact secure@symantec.com if you feel you have discovered a potential or actual security issue with a Symantec product. A Symantec Product Security team member will contact you regarding your submission. Symantec has developed a Product Vulnerability Handling Process document outlining the process we follow in addressing suspected vulnerabilities in our products. We support responsible disclosure of all vulnerability information in a timely manner to protect Symantec customers and the security of the Internet as a result of vulnerability. This document is available from the location provided below. Symantec strongly recommends using encrypted email for reporting vulnerability information to secure@symantec.com. The Symantec Product Security PGP key can be obtained from the location provided below. Symantec-Product-Vulnerability-Response Symantec Vulnerability Response Policy Symantec Product Vulnerability Management PGP Key Symantec Product Vulnerability Management PGP Key Copyright (c) 2005 by Symantec Corp. Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com. Disclaimer The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. Symantec, Symantec products, Symantec Security Response, and SymSecurity are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners. Initial Post on: Monday, 19-Sep-05 14:25:00 Last modified on: Monday, 19-Sep-05 14:39:38 [***** End Symantec SYM05-014 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Symantec for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) P-299: 'cvsbug' Security Update P-300: Cisco IOS Firewall Authentication Proxy for FTP and Telnet Sessions Vulnerability P-301: httpd Security Update P-302: Cisco CSS SSL Authentication Bypass Security Notice P-303: Firefox and Mozilla Buffer Overflow Vulnerability P-304: XFree86 Security Update P-305: Sun JAR File Contents Disclosure P-306: Apple Java Security Updates P-307: TWiki History Function Vulnerability P-308: 'kcheckpass' Vulnerability