Title: Symantec Enterprise Firewall / Gateway Security HTTP Proxy Internal IP Leakage Weakness
Severity: MODERATE
Description:
Symantec Enterprise Firewall is an enterprise level firewall available for Microsoft Windows and Unix operating systems. Symantec Gateway Security is a device providing firewall and intrusion detection functionality.
Symantec Enterprise Firewall and Gateway Security products are prone to an information-disclosure weakness.
The vendor has reported that the NAT/HTTP proxy component of the products may reveal the internal IP addresses of protected computers. These IP addresses should normally be hidden by Network Address Translation (NAT), however, the products disclose the addresses when handling certain specially crafted HTTP requests. Specifically, requests of the form 'get/XX HTTP/1.0' will trigger this issue.
An attacker may use this information to carry out targeted attacks against a potentially vulnerable host.
Affected Products:
- Symantec Enterprise Firewall 8.0.0
- Symantec Gateway Security 5000 Series 2.0.1
- Symantec Gateway Security 5000 Series 3.0.0
References:
- SEC-Consult: SEC Consult Security Advisory 20060512-0
- Symantec: Enterprise Support Site
- Symantec: SYM06-009 - Symantec Enterprise Firewall NAT/HTTP Proxy internal IP leakage
- Symantec: Symantec Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
