Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Symantec Alert Management System HNDLRSVC Arbitrary Command Execution

Subscribe

Check Point Reference: CPAI-2010-170
Date Published:
Severity:
Source: Discoverer's advisory
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Symantec Antivirus Corporate Edition 10.1.8.8000 and prior
Symantec Systems Center 10.1.8.8000 and prior
Symantec Client Security 3.1.8 and prior
Vulnerability Description
An arbitrary command execution vulnerability exists in Symantec Alert Management System (AMS2) service shipped with multiple Symantec products. The AMS service starts an alert handler service, HNDLRSVC, that listens for commands from the AMS server. The service does not perform proper authentication checks before executing such commands. Remote attackers can exploit this vulnerability by sending a crafted packet to the target system, potentially leading to remote code execution.
Update/Patch Available
The vendor has not released an advisory addressing this issue.
Vulnerability Details
A design weakness vulnerability exists in Symantec alert handler service, HNDLRSVC, installed by the Alert Management System. Remote attackers can exploit this vulnerability by sending a crafted packet to the service. The affected service will also allow attackers to run programs from a remote network share.

Protection Overview
The protection will detect and block invalid packets between the AMS Client and Server applications.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Application Intelligence > Enterprise Software, and select the Symantec Alert Management System protection group.
3. Click Symantec Alert Management System HNDLRSVC Arbitrary Command Execution (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name: Symantec Alert Management System
Description: Symantec Alert Management System HNDLRSVC Arbitrary Command Execution