Symantec Windows LiveUpdate potential for minor Denial of Service and Directory Traversal

Revision History:  None

Risk Impact: Very low

Overview
Symantec is responding to an advisory (http://www.hexview.com/docs/20041104-1.txt) issued concerning the potential for a minor denial of service (DoS) during a client’s Symantec Windows LiveUpdate download from an actual or spoofed Symantec LiveUpdate server. In addition, the advisory states there is potential for a limited directory traversal vulnerability since Symantec Windows LiveUpdate fails to validate file path input during decompression of included file path data.

NOTE: Neither of these potential issues could be used to deploy malware or result in remote access to a client system.

Affected Components
Symantec Windows LiveUpdate 1.80.x, 1.90.x, 2.0.x, 2.5.x

Details
The posted advisory states that Symantec’s Windows LiveUpdate does not do proper size checking on downloaded archive zip files. This could potentially allow an external attacker, who has been able to spoof a Symantec LiveUpdate download site, or a hostile insider with privileged access to a valid LiveUpdate server to include an oversized zip file in the initial download package. Decompressing an overly large zip file could potentially consume all system resources resulting in a DoS condition on the client system. Killing the running Symantec LiveUpdate process or a system restart would clear the DoS. Additionally, according to the advisory, Symantec Windows LiveUpdate does not properly validate content in the file path of downloaded archive files. This could allow an attacker to modify the path in such a manner to download archive files to arbitrary locations on the targeted system.

Symantec Response
The Symantec Windows LiveUpdate component is an essential piece of technology providing a method to deliver product and virus definition updates directly to the desktop, gateway or server. Symantec engineers have thoroughly tested these issues. While it is potentially possible to do what the advisory states, there are some basic misunderstandings in the impact of as well as the ability to successfully accomplish this type of attack involving Symantec Windows LiveUpdate.

Symantec LiveUpdate servers, as are any servers, are potentially susceptible to misdirection, attacks. This is an Internet infrastructure problem, not only a Symantec problem. However, were such an attack to occur, only a very small percentage of a very large user base could potentially be impacted to any degree by a spoofing or misdirection attack since, by its very nature, such an attack would be limited to a local Internet area/region.

Symantec Windows LiveUpdate does not currently perform size validation on the initial download file. This initial file is a very small catalog file reflecting which installed Symantec applications have available updates. The zip library used by Symantec Windows LiveUpdate only extracts a specific subset of the content of the initial archive file downloaded so “redirecting” these files to locations other than their expected location would have minimal impact other than potential usability problems.

While Symantec considers the issues outlined in this reported advisory to be low-risk, and to have a low probability of occurrence Symantec considers the reports of possible vulnerabilities in any Symantec product to be very important. We will be adding additional capabilities to mitigate any potential actions of this nature in an update that will be available shortly.

http://securityresponse.symantec.com/avcenter/security/Content/2004.11.23.html

Leave a Reply