Onderwerp: [HV-LOW] Symantec LiveUpdate issues may cause DoS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Symantec LiveUpdate issues may cause DoS

Classification:
===============
Level: [LOW]-med-high-crit
ID: HEXVIEW*2004*11*04*1
URL: http://www.hexview.com/docs/20041104-1.txt

Overview:
=========
Symantec LiveUpdate is an application designed to provide
timely updates for Symantec products. LiveUpdate downloads
zip-archived packages, decompresses them, verifies signatures,
and finally installs the updates. HexView discovered two problems
with LiveUpdate: decompression routine does not check for
uncompressed file sizes and no validation is performed on
directory names.

Affected products:
==================
HexView tested the issue using LiveUpdate versions 1.80.19.0 and
2.5.56.0 running on Windows XP SP1. Probably all other LiveUpdate
versions are vulnerable.

Cause and Effect:
=================
After downloading ZIP archive off the website (either legitimate
Symantec website or a spoofed one controlled by attacker)
LiveUpdate starts decompressing a set of files it expects to
find in an archive. LiveUpdate does not perform uncompressed file
size validation, so it is possible to cause an effective DoS by
forcing LiveUpdate to decompress an extremely large file that will
consume all available hard drive space. This issue is known as
"ZIP bombing".

LiveUpdate also decompresses a directory tree without validation
of directory names. Directory traversal is possible through ".."
meaning that LiveUpdate can be forced to create a directory anywhere
on the current disk. While LiveUpdate will not overwrite existing
files, this issue can be exploited to mount a DoS attack against
applications by creating a directory using the name of the file that
victim application is expected to create. Once such directory is
created, the application will fail to create the file which will
cause unpredictable results.

LiveUpdate 1.80.19 cleans up after itself, but it only deletes
files, not directories. LiveUpdate 2.5.56 does not delete files
when failure occurs.

It is possible to repackage Symantec's legitimate archives so they
will be cleanly processed by LiveUpdate and the fact of attack will
not be noticed.

Vendor Status:
==============
Symantec was notified on 2004-11-03. No response received.

About HexView:
==============
HexView contributes to online security-related lists for almost a
decade. The scope of our expertize spreads over Windows, Linux, Sun,
MacOS platforms, network applications, and embedded devices. The chances
are you read our advisories or disclosures. For more information visit
http://www.hexview.com

Distribution:
=============
This document may be freely distributed through any channels as long as
the contents are kept unmodified. Commercial use of the information in
the document is not allowed without written permission from HexView
signed by our pgp key.

HexView Disclosure Policy:
==========================
HexView notifies vendors that have publicly available contact e-mail 24
hours before disclosing any information to the public. If we are unable
to find vendor's e-mail address or if no reply is received within 24
hours, HexView will publish vulnerability notification including all
technical details unless the issue is rated as "critical". If vendor
does not reply within 72 hours, HexView may disclose all details for
critical vulnerabilities as well.

If vendor replies within the above mentioned time period, HexView will
announce the vulnerability, but will not disclose the details required
to reproduce it. HexView will also specify the date when full disclosure
containing all the details will be published. The time period between
announcement and full disclosure is 30 days unless there is an agreement
with vendor and appropriate justification for extension. If vendor
resolves the issue earlier than 30 days after announcement, HexView will
publish full disclosure as soon as the fix is available to the public.

HexView also reserves the right to publish any detail of any
vulnerability at any time.

Feedback and comments:
======================
Feedback and questions about this disclosure are welcome at
vtalk@hexview.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFBir/0DPV1+KQrDqQRAl70AJ9UzaZgvKTAjnpPKYHJLeeZAHc6AwCdG 2hp
lAOH7ly90UoQRE9ib2b9XPc=
=wZTd
-----END PGP SIGNATURE-----

Symantec is aware of this posting. Symantec engineers are reviewing the issue. If it is validated we will respond accordingly.

According to HexView's advisory, Symantec was notified 2004-11-03 and did not respond prior to HexView's posting.
However, HexView's initial notification to Symantec was received late afternoon on 2004-11-03 and Symantec's initial response acknowledgement and offer of coordination in reviewing and reporting if found to be valid went back to HexView the following morn
ing, 2004-11-04, well within the 24 hour window that is published in their stated disclosure policy. No further communications of any nature have been received from HexView concerning this issue.

Symantec takes the security of our products seriously and is a responsible disclosure organization. We would like to work directly with anyone who believes they have found a security issue in a Symantec product to validate the problem and coordinate a re
sponse.

Please contact secure@symantec.com concerning security issues with Symantec products.

Symantec Product Security
secure@symantec.com
-----------------------------------------

vuln@hexview.com

To
bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
cc

Subject
[HV-LOW] Symantec LiveUpdate issues may cause DoS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Symantec LiveUpdate issues may cause DoS

Classification:
===============
Level: [LOW]-med-high-crit
ID: HEXVIEW*2004*11*04*1
URL: http://www.hexview.com/docs/20041104-1.txt

Overview:
=========
Symantec LiveUpdate is an application designed to provide timely updates for Symantec products. LiveUpdate downloads zip-archived packages, decompresses them, verifies signatures, and finally installs the updates. HexView discovered two problems
with LiveUpdate: decompression routine does not check for uncompressed file sizes and no validation is performed on directory names.

----------------------snip-------------------------------------------
Vendor Status:
==============
Symantec was notified on 2004-11-03. No response received.

About HexView:
==============
HexView contributes to online security-related lists for almost a decade. The scope of our expertize spreads over Windows, Linux, Sun, MacOS platforms, network applications, and embedded devices. The chances are you read our advisories or disclosures. For
more information visit
http://www.hexview.com

----------------------snip-----------------------------
HexView Disclosure Policy:
==========================
HexView notifies vendors that have publicly available contact e-mail 24 hours before disclosing any information to the public. If we are unable to find vendor's e-mail address or if no reply is received within 24 hours, HexView will publish vulnerability
notification including all technical details unless the issue is rated as "critical". If vendor does not reply within 72 hours, HexView may disclose all details for
critical vulnerabilities as well.

If vendor replies within the above mentioned time period, HexView will announce the vulnerability, but will not disclose the details required to reproduce it. HexView will also specify the date when full disclosure
containing all the details will be published. The time period between announcement and full disclosure is 30 days unless there is an agreement with vendor and appropriate justification for extension. If vendor
resolves the issue earlier than 30 days after announcement, HexView will publish full disclosure as soon as the fix is available to the public.