Secunia

eEye Digital Security has discovered a vulnerability in various Symantec Client Firewall products, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within "SYMNDIS.SYS" when performing low level processing of TCP packets. This can be triggered via a single TCP packet containing a TCP option of either SACK (05) or Alternate Checksum Data (0F) followed by a length field set to zero (00).

Successful exploitation causes the component to enter an infinite loop, which halts the user's system rendering it inoperable.

The vulnerability affects the following products:
* Symantec Norton Internet Security and Professional 2003, 2004
* Symantec Norton Personal Firewall 2003, 2004
* Symantec Client Firewall 5.01, 5.1.1
* Symantec Client Security 1.0 and 1.1

Solution
Patches are available via the LiveUpdate feature and technical support channels.
Further details available in Customer Area

Provided and/or discovered by
Karl Lynn, eEye Digital Security.

Changelog
Further details available in Customer Area

Original Advisory
Symantec:
http://www.sarc.com/avcenter/security/Content/2004.04.20.html

eEye Digital Security:
http://www.eeye.com/html/Research/Advisories/AD20040423.html

Deep Links
Links available in Customer Area