CVE-2016-5309 - Out-of-bounds Read

Severity

43%

Complexity

86%

Confidentiality

48%

The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud; Symantec Data Center Security: Server; Symantec Endpoint Protection (SEP) for Windows before 12.1.6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1.6 MP6; Symantec Endpoint Protection for Small Business Enterprise (SEP SBE/SEP.Cloud); Symantec Endpoint Protection Cloud (SEPC) for Windows/Mac; Symantec Endpoint Protection Small Business Edition 12.1; CSAPI before 10.0.4 HF02; Symantec Protection Engine (SPE) before 7.0.5 HF02, 7.5.x before 7.5.4 HF02, 7.5.5 before 7.5.5 HF01, and 7.8.x before 7.8.0 HF03; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF2.1, 8.1.x before 8.1.2 HF2.3, and 8.1.3 before 8.1.3 HF2.2; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 6.5.8_3968140 HF2.3, 7.x before 7.0_3966002 HF2.1, and 7.5.x before 7.5_3966008 VHF2.2; Symantec Protection for SharePoint Servers (SPSS) before SPSS_6.0.3_To_6.0.5_HF_2.5 update, 6.0.6 before 6.0.6 HF_2.6, and 6.0.7 before 6.0.7_HF_2.7; Symantec Messaging Gateway (SMG) before 10.6.2; Symantec Messaging Gateway for Service Providers (SMG-SP) before 10.5 patch 260 and 10.6 before patch 259; Symantec Web Gateway; and Symantec Web Security.Cloud allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted RAR file that is mishandled during decompression.

CVSS 3.0 Base Score 5.5. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P).

Demo Examples

Out-of-bounds Read

CWE-125

In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the method


               }
                     return value;// check that the array index is less than the maximum// length of the array
                           value = array[index];// get the value at the specified index of the array
// if array index is invalid then output error message// and return value indicating errorvalue = -1;

However, this method only verifies that the given array index is less than the maximum length of the array but does not check for the minimum value (CWE-839). This will allow a negative value to be accepted as the input array index, which will result in a out of bounds read (CWE-125) and may allow access to sensitive memory. The input array index should be checked to verify that is within the maximum and minimum range required for the array (CWE-129). In this example the if statement should be modified to include a minimum range check, as shown below.


               ...// check that the array index is within the correct// range of values for the array

Overview

Type

Symantec

First reported 8 years ago

2017-04-14 18:59:00

Last updated 8 years ago

2017-04-25 18:58:00

Affected Software

Symantec Mail Security For Domino 8.1.2

8.1.2

Symantec Mail Security for Domino 8.1.3

8.1.3

Symantec Mail Security For Microsoft Exchange 7.0

7.0

Symantec Mail Security For Microsoft Exchange 7.0.1

7.0.1

Symantec Mail Security For Microsoft Exchange 7.0.2

7.0.2

Symantec Mail Security For Microsoft Exchange 7.0.3

7.0.3

Symantec Mail Security for Microsoft Exchange 7.0.4

7.0.4

Symantec Mail Security For Microsoft Exchange 7.5

7.5

Symantec Mail Security For Microsoft Exchange 7.5.1

7.5.1

Symantec Mail Security For Microsoft Exchange 7.5.2

7.5.2

Symantec Mail Security For Microsoft Exchange 7.5.3

7.5.3

Symantec Mail Security for Microsoft Exchange 7.5.4

7.5.4

Symantec Protection Engine 7.5.0

7.5.0

Symantec Protection Engine 7.5.1

7.5.1

Symantec Protection Engine 7.5.2

7.5.2

Symantec Protection Engine 7.5.3

7.5.3

Symantec Protection Engine 7.5.4

7.5.4

Symantec Protection Engine 7.5.5

7.5.5

Symantec Protection Engine 7.8.0

7.8.0

Symantec Protection For SharePoint Servers 6.0.3

6.0.3

Symantec Protection For SharePoint Servers 6.0.4

6.0.4

Symantec Protection For SharePoint Servers 6.0.5

6.0.5

Symantec Protection For SharePoint Servers 6.0.6

6.0.6

Symantec Protection For SharePoint Servers 6.0.7

6.0.7

References

https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160919_00

Vendor Advisory