PT-2006-3306 · Symantec · Symantec Gateway Security 5000 Series+1

Published 2006-05-12 · Updated 2018-10-18 · CVE-2006-2341

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symantec Gateway Security 5000 Series versions 2.0.1 through 3.0 Symantec Enterprise Firewall version 8.0

Description The issue allows remote attackers to determine internal IP addresses by using malformed HTTP requests. This can be achieved by sending a get request without a space separating the URI, effectively bypassing NAT and exposing internal IP addresses.

Recommendations For Symantec Gateway Security 5000 Series versions 2.0.1 through 3.0, consider restricting access to the HTTP proxy to minimize the risk of exploitation. For Symantec Enterprise Firewall version 8.0, avoid using NAT with malformed HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2006-2341

Affected Products

Symantec Enterprise Firewall

Symantec Gateway Security 5000 Series

References · 10

• 🔥 http://securityfocus.com/bid/17936 · Exploit
• 🔥 https://exploit-db.com/exploits/27852 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2341 · Security Note
• http://vupen.com/english/advisories/2006/1764 · Vendor Advisory
• http://securitytracker.com/id?1016057 · Patch
• http://secunia.com/advisories/20082 · Vendor Advisory
• http://securitytracker.com/id?1016058 · Patch
• http://securityresponse.symantec.com/avcenter/security/Content/2006.05.10.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26370 · Note
• http://securityfocus.com/archive/1/433876/30/5040/threaded · Note