ID

VAR-200212-0740

CVE

CVE-2002-2294

TITLE

Symantec Enterprise Firewall RealAudio Proxy remote buffer overflow vulnerability

DESCRIPTION

Multiple buffer overflows in Symantec Raptor Firewall 6.5 and 6.5.3, Enterprise Firewall 6.5.2 and 7.0, VelociRaptor 500/700/1000 and 1100/1200/1300, and Gateway Security 5110/5200/5300 allow remote attackers to cause a denial of service (service termination) via (1) malformed RealAudio (rad) packets that are not properly handled by the RealAudio Proxy, or (2) crafted packets to the statistics service (statsd). A vulnerability has been reported for Symantec Enterprise Firewall. A buffer overflow vulnerability occurs in the RealAudio Proxy installed on Symantec Enterprise Firewall. Reportedly when the Proxy is sent a specially formatted stream of data, it will trigger a buffer overflow condition. An attacker can exploit this vulnerability and send a specially crafted stream of data to the Proxy . This will result in a local buffer to be overrun with attacker supplied values and will trigger the buffer overflow condition. Although unconfirmed, it may be possible for an attacker to gain control over the execution of the vulnerable RealAudio Proxy process. There is a problem in the RealAudio proxy service program when processing special scans. Remote attackers can use this vulnerability to carry out buffer overflow attacks, which can cause denial of service attacks on the system. When scanning firewalls with the Qualys tool, the rad (RealAudio) and statsd (statistics) services were incorrectly terminated. Dr. Watson can record this core dump, scanning the sent data can cause the RealAudio service to destroy the buffer, and the statistical service, statsd, will stop responding due to an access violation. All other services function normally

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

buffer overflow

EXTERNAL IDS

REFERENCES

CREDITS

Symantec

SOURCES

LAST UPDATE DATE

2024-08-14T15:20:19.530000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE