Secunia

ISS X-Force has reported a vulnerability in multiple Symantec products, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the Entrust LibKmp library used for processing ISAKMP packets. This can be exploited to cause a heap-based buffer overflow via a specially crafted ISAKMP packet during negotiation.

Successful exploitation may cause the VPN component to crash or potentially allow execution of arbitrary code.

The following products are affected:
* Symantec VelociRaptor 1.5
* Symantec Gateway Security 1.0
* Symantec Gateway Security 2.0
* Symantec Enterprise Firewall/VPN 7.0 for Solaris
* Symantec Enterprise Firewall/VPN 7.0 for Windows NT/2000
* Symantec Enterprise Firewall/VPN 7.0.4 for Solaris
* Symantec Enterprise Firewall/VPN 7.0.4 for Windows NT/2000
* Symantec Enterprise Firewall 8.0 for Windows
* Symantec Enterprise Firewall 8.0 for Solaris

Solution
Apply patches (see original advisories for installation instructions).
Further details available in Customer Area

Provided and/or discovered by
Mark Dowd and Neel Mehta, ISS X-Force.

Changelog
Further details available in Customer Area

Original Advisory
ISS advisory:
http://xforce.iss.net/xforce/alerts/id/181

Symantec advisory:
http://securityresponse.symantec.com/avcenter/security/Content/2004.08.26.html

Deep Links
Links available in Customer Area