Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and License Our Database or Notification Service
F-Secure Internet Gatekeeper Input Validation Bug in Content Scanner Server Lets Remote Users Deny Service
SecurityTracker Alert ID: 1011201|
SecurityTracker URL: http://securitytracker.com/id/1011201
(Links to External Site)
Date: Sep 9 2004
Denial of service via network|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): 6.32 and prior versions; tested on 6.31 build 33|
iDEFENSE reported an input validation vulnerability in F-Secure Internet Gatekeeper. A remote user can cause denial of service conditions on the Content Scanner Server.|
It is reported that a remote user can connect to the Content Scanner on port 18971 and send a malformed packet to trigger a crash in the service. The service will restart in approximately 30 to 40 seconds, the report said.
F-Secure Anti-Virus for Microsoft Exchange is also affected.
The vendor was notified on August 25, 2004.
The original advisory is available at:
A remote user can cause the Content Scanner service to crash and reboot.|
The vendor has released a hotfix, available at:|
The vendor reports that F-Secure Anti-virus for Microsoft Exchange 6.30 and F-Secure Internet Gatekeeper 6.40 are not affected.
Vendor URL: www.f-secure.com/security/fsc-2004-2.shtml (Links to External Site)
Exception handling error, Input validation error|
Windows (2000), Windows (2003)|
Source Message Contents
Date: Thu, 9 Sep 2004 12:03:40 -0400|
Subject: iDEFENSE Security Advisory 09.09.04: F-Secure Internet Gatekeeper
F-Secure Internet Gatekeeper Content Scanning Server Denial of Service
iDEFENSE Security Advisory 09.09.04
September 9, 2004
F-Secure Internet Gatekeeper is an antivirus and content filtering
solution for protecting SMTP and HTTP traffic at the Internet gateway.
Additional information is available at:
Remote exploitation of an input validation error in F-Secure's Internet
Gatekeeper could allow attackers to trigger a denial of service against
the Content Scanner Server.
F-Secure Internet Gatekeeper is an automated antivirus, content
filtering and access control solution for e-mail and Web traffic at the
Internet Gateway. The problem specifically exists in the handling of
malformed packets received by the Content Scanner on port 18,971. A
denial of service condition is triggered during the parsing of the
packet, causing the application to fail with an access violation error.
The vulnerability does not appear to be further exploitable.
Successful exploitation allows remote attackers to crash the service.
Once the server has crashed, depending on configuration options, a
dialog box may appear on the desktop indicating that the FSAVSD.EXE
process has crashed. Once this has been cleared, or if there is no
dialog box, the server will automatically restart after approximately 30
to 40 seconds. During this time, the server will not respond to any
requests made of it. It is possible to cause the server to fail
repeatedly by sending packets at short intervals.
iDEFENSE has confirmed that F-Secure Internet Gatekeeper Server 6.31
build 33 is vulnerable.
The vendor has reported that the following versions are vulnerable:
- F-Secure Anti-Virus for Microsoft Exchange 6.21 and earlier
- F-Secure Anti-Virus for Microsoft Exchange 6.01 and earlier=20
- F-Secure Internet Gatekeeper 6.32 and earlier=20
Vendor supplied workaround:
The product can be configured so that only allowed connections are
accepted by the F-Secure Content Scanner Server.
- Configure CSS to accept connections only from known IP addresses:
* In F-Secure Policy Manager Console, go to F-Secure Content Scanner
Server>Settings>Interface and in the "Accept Connections" setting
specify the comma-separated list of IP addresses the server will accept
* In the local user interface, a similar setting can be found on the
Interface tab page under the Server/Interface category.
VI. VENDOR RESPONSE
"We have confirmed the problem with CSS 6.31 which is included in both
F-Secure Anti-Virus for Microsoft Exchange 6.01 and 6.21 and also in
F-Secure Internet Gatekeeper 6.32. The problem exists also in the older
version, CSS 6.30 which was included in F-Secure Anti-Virus for
Microsoft Exchange 6.20 and F-Secure Internet Gatekeeper 6.30/6.31.
However, the latest released version of the products: F-Secure
Anti-virus for Microsoft Exchange 6.30 and F-Secure Internet Gatekeeper
6.40 which include F-Secure Content Scanner Server 6.40, are not
affected by this anymore.
The reason for the problem was incorrect exception handling. In the new
version of the product the situation [is] fixed with new design and
added validity checks.
We do not consider this a major issue because the products are installed
in the company internal network or at least in DMZ so the port should
not be exposed to the public Internet."
A hotfix is available from:
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the=20
names CAN-2004-0830 to these issues. This is a candidate for inclusion=20
in the CVE list (http://cve.mitre.org), which standardizes names for=20
VIII. DISCLOSURE TIMELINE
08/25/2004 Initial vendor notification
08/25/2004 iDEFENSE clients notified
08/25/2004 Initial vendor response
09/09/2004 Coordinated public disclosure
The discoverer of this vulnerability wishes to remain anonymous.
Get paid for vulnerability research
X. LEGAL NOTICES
Copyright (c) 2004 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email email@example.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
Go to the Top of This SecurityTracker Archive Page