Symantec products that ship a third-party Autonomy KeyView filter have updated the module to address a vulnerability in the processing of specifically crafted OLE documents reported against the KeyView module.
Product
|
Version
|
Build
|
Solution(s)
—|—|—|—
Symantec Mail Security for Domino
|
8.0.2
8.0.1
8.0
|
All
|
SMSDOM 8.0.3
Symantec Mail Security for Domino
|
7.5.8
7.5.7
7.5.6
7.5.5.32
7.5.4.29
7.5.3.25
|
All
|
SMSDOM 7.5.9
Symantec Mail Security for Microsoft Exchange
|
6.0.9
6.0.8
6.0.7
6.0.6
|
All
|
SMSMSE 6.0.10
Symantec Mail Security for Microsoft Exchange
|
5.0.13
5.0.12
5.0.11
5.0.10
|
All
|
Version 5.0 and its subsequent releases reached EOSS on 9/23/2009
Upgrade to SMSMSE 6.0.10
Symantec BrightMail Gateway
|
8.x and earlier
|
All
|
BrightMail Gateway 9.0
Symantec Mail Security for SMTP (EOL)
|
5.0.x
|
All
Symantec Data Loss Prevention Enforce/Detection Servers for Windows
|
8.1.1
9.x
10.0
|
All
|
Hotfix_8.1.10.8_Windows
Symantec_DLP_9.0.3_ReleaseUpdate_Win-IN.zip - Windows Server
Hotfix_10.0.1010.18007_Windows
Symantec Data Loss Prevention Enforce/Detection Servers for Linux
|
8.1.1
9.x
10.0
|
All
|
Hotfix_8.1.10.8_Linux
Symantec_DLP_9.0.3_ReleaseUpdate_Lin-IN.zip - Linux Server
Hotfix_10.0.1010.18007_Linux
Symantec Data Loss Prevention Endpoint Agents
|
8.1.1
|
All
|
Hotfix_8.1.10.9
Symantec Data Loss Prevention Endpoint Agents
|
9.x
|
All
|
Symantec_DLP_9.0.3_Agent_Win-IN.zip - Agent
Symantec Data Loss Prevention Endpoint Agents
|
10.0
|
All
|
Hotfix_10.0.1010.18007
Symantec IM Manager 2007
|
8.x
|
All
|
Update to 8.4.13
Note:
The Symantec BrightMail Gateway and Symantec Mail Security for SMTP 5.x.x run the KeyView module out-of-process so there is negligible impact from this issue. However as Symantec Mail Security for SMTP 5.x has reached End-of-Life (EOL), that product will not be updated. Customers still running SMS for SMTP 5.x should transition to the Symantec BrightMail Gateway Appliance and apply all available updates.
Software update to SBG version 9.0 is ONLY available from systems running SBG version 8.0.3
Symantec DLP 7.x Enforce/Detection Servers are affected. DLP 7.x Endpoint Agents are NOT affected.
Symantec DLP customers that need to update Symantec DLP 8.1 Enforce/Detection Servers or Endpoint Agents MUST first update to Symantec DLP v8.1.1. Following application of the v8.1.1 upgrade apply the Symantec DLP 8.1.x hotfixes identified above.
Symantec IM Manager 2007 customers running versions 8.4.12 and prior (including 8.3.x) should upgrade 8.4.13
Products Not Affected
Product
|
Version
—|—
Symantec Mail Security for Domino
|
SMSDOM MPE 3.2
SMSDOM 5.1
Symantec Mail Security for Microsoft Exchange
|
All versions prior to 5.0.10
Symantec Mail Security for Microsoft Exchange
|
All 6.0.x versions prior to 6.0.5
Symantec Data Loss Prevention Endpoint Agents
|
7.x
Severity
Medium
NOTE: Many of the affected products currently run the Autonomy KeyView module out-of- process with limited privileges further reducing the impact of this issue on most affected Symantec applications
Remote Access
|
Yes
—|—
Local Access
|
No
Authentication Required
|
No
Exploit publicly available
|
No
Details
iDefense Labs notified Symantec of a multi-vendor buffer overflow vulnerability reported against the Autonomy KeyView module shipped and installed with identified Symantec products. The overflow can occur during the processing of incoming specifically formatted OLE documents.
Symantec Response
Symantec product engineers have implemented updates for this issue in all affected product versions.
In many of the affected Symantec products, the Autonomy KeyView module processes have been separated from the Symantec application processes (handled out-of-process) with very limited privileges on the system. This out-of-process method specifically addresses these types of security concerns. Any attempt to exploit the Autonomy KeyView module results in process termination of the offending thread and an error message generated to and handled by the specific application.
Symantec knows of no exploitation of or adverse customer impact from these issues.
Update Information
Updates will be available from your normal support/download locations.
SMS for Domino and Microsoft Exchange updates are available through the Platinum Support Web Site for Platinum customers or through the FileConnect -Electronic Software Distribution web site.
Symantec DLP updates are available for download through secure file exchange.
Symantec IM Manager updates are available through the FileConnect -Electronic Software Distribution web site.
Workaround
Temporary Workaround for Symantec Mail Security for Domino
Installations of SMS for Domino 7.5 and 8.0 that do not utilize the Content Filtering capabilities of the product are not susceptible to this issue. SMS for Domino 7.5 and 8.0 would be susceptible only if the attachment content scanning option is enabled.
As an interim workaround, administrators unable to upgrade to the recommended solution may disable content filtering rules that contain parameters that specify scanning of attachment content. The rules do not need to be deleted, only disabled until the updated release is installed.
To disable the content filtering rules for Symantec Mail Security for Domino
Temporary Workaround for Symantec Mail Security for Microsoft Exchange
Installations of SMS for Microsoft Exchange 5.x that do not utilize the Content Filtering capabilities of the product are not susceptible. SMS for Microsoft Exchange 5.x is susceptible only if the attachment content scanning option is enabled.
As an interim workaround, administrators unable to upgrade to the recommended solution may disable content filtering rules that contain parameters that specify scanning of attachment content. The rules do not need to be deleted, only disabled until the updated release is installed.
Temporary Workaround for Symantec Mail Security and Symantec Brightmail Gateway
Risk from this vulnerability is limited on installations of SMS for SMTP and SMS Gateway in which the attachment content scanning option is enabled. However, installations that do not utilize the Content Filtering capabilities of the product are not susceptible to this issue.
As an interim workaround, administrators unable to upgrade to the recommended solution may disable content filtering rules that contain parameters that specify scanning of attachment content. The rules do not need to be deleted, only disabled until the updated release is installed.
To disable the content filtering rules for SMS for SMTP and SMS Gateway 5.x:
To disable the content filtering rules for SMS/SBM Gateway after 5.x:
Temporary Workaround for Symantec IM Manager
Installations of Symantec IM Manager 2007 which do not use the "Block selected file types" functionality or the entire "File Transfer" functionality are not susceptible to this issue.
Symantec IM Manager 2007 would be susceptible only if the "Block selected file types" for the File Transfer rule is enabled.
To disable the "Block selected file types" rules for Symantec IM Manager 2007
Best Practices
As part of normal best practices, Symantec strongly recommends:
This issue is credited to Joshua J. Drake with iDefense Labs.
Security Focus, http://www.securityfocus.com, has assigned a Bugtraq ID (BID) 38468 to this issue for inclusion in the Security Focus vulnerability database.
This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. CVE-2009-3032 has been assigned to this issue.