Symantec personal firewalls contain a flaw that may allow a remote attacker to freeze the system and force a reboot. The issue is due to DNS response validation code not properly handling malformed DNS packets. By sending a specially crafted single packet, an attacker can cause the system to enter an infinite loop within the kernel, effectively freezing the system. A system reboot would be required to resume normal operations.

Currently, there are no known workarounds or upgrades to correct this issue. However, Symantec has released a patch to address this vulnerability. Customers can obtain the update via the LiveUpdate utility:

1. Open any installed Symantec product
2. Click on LiveUpdate in the toolbar
3. Run LiveUpdate until Symantec LiveUpdate indicated that all installed Symantec products are up-to-date

• CVE ID: 2004-0445 (see also: NVD)
• Milw0rm: 299
• Exploit Database: 299
• Related OSVDB ID: 6099 6101 6102
• Keyword: AD20040512B SYM04-008
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-05/0131.html
• Other Advisory URL: http://research.eeye.com/html/advisories/published/AD20040512B.html
  http://www.eeye.com/html/Research/Advisories/AD20040512B.html [ Link is 404 ]
• Vendor Specific Advisory URL: http://securityresponse.symantec.com/avcenter/security/Content/2004.05.12.html

• Barnaby Jack - eEye Digital Security
• Karl Lynn - eEye Digital Security
• Derek Soeder - eEye Digital Security