Initial Publication Date: Advisory Status: Advisory Severity: Legacy ID
20 Feb 2002 Closed Medium
Corsaire Limited discovered an issue with the way Symantec Enterprise Firewall handled SNMP notify alerts that could cause alerts to be dropped in certain instances.
Note: The SNMP notify daemon issue addressed by Corsaire Limited in their Advisory is NOT related to CERT Advisory CA-2002-03, Multiple Vulnerabilities in Many Implementations of the Simple Network Management Protocol (SNMP)
Symantec Enterprise Firewall versions 6.5.x and 7.0
Corsaire Limited notified Symantec Corporation of an issue in the way Symantec Enterprise Firewall handled some event alerts. This issue could, potentially, result in the failure of event alerts to be logged or the administrator to be notified.
Symantec Enterprise Firewall provides many methods to alert an administrator about firewall log events based on the functionality of a subsystem called the Notify daemon. One of these notification methods sends SNMP traps to the network management station where they are centrally managed. However, if the firewall log entry exceeds an established size threshold, the Notify daemon drops the SNMP trap and logs a "failed to notify" error message instead.
In the event that SNMP is the only alert mechanism used, the administrator may fail to receive notifications for which he or she has established alert criteria.
Symantec has verified the logging issues identified by Corsaire Limited. The problem exists in the way the Notify daemon allocates the buffer size for the SNMP traps. In certain instances, while encoding the SNMP trap, the message may exceed the allocated buffer size. In these instances, the SNMP trap is dropped and the error message is logged.
Note: This problem is a notification handling issue only. The issue does not allow unauthorized access to the system nor is it possible to maliciously create a DoS condition using this issue.
To address this SNMP issue, Symantec has developed hotfixes available for download for affected versions:
Symantec takes the security of its products very seriously. Symantec appreciates the coordination of Martin O'Neal and Corsaire Limited in identifying and providing technical details of potential areas of concern so it can quickly address the issue
This is machine translated content
Login to Subscribe
Please login to set up your
Would you like to be subscribed to future notifications for this article?
For security reasons, your link to this document has expired. Please click on the attachment link to access this file.
The attachment that you are looking for no longer exists.
There has been an issue retrieving your attachment. Please try again.
Currently server is down.
Didn't find the article you were looking for? Try these resources.