Secunia

fryxar has discovered a vulnerability in various Symantec firewall products, which can be exploited by malicious people to poison the DNS cache.

When acting as a caching DNS server, the integrated DNS proxy (DNSd) trusts any answer received from a DNS server without checking that it actually corresponds to a query or is valid. This can be exploited to insert fake information in the DNS cache, which can be used to direct users to malicious web sites or just prevent them from accessing certain web sites.

The vulnerability affects the following products:
* Symantec Gateway Security 5400 Series, v2.0
* Symantec Gateway Security 5300 Series, v1.0
* Symantec Enterprise Firewall, v7.0.x (Windows and Solaris)
* Symantec Enterprise Firewall v8.0 (Windows and Solaris)
* Symantec VelociRaptor, Model 1100/1200/1300
* Symantec VelociRaptor, Model 500/700/1000

Solution
Apply appropriate hotfixes.
Further details available in Customer Area

Provided and/or discovered by
fryxar

Changelog
Further details available in Customer Area

Original Advisory
Symantec:
http://www.sarc.com/avcenter/security/Content/2004.06.21.html

Deep Links
Links available in Customer Area