CVE-2004-0375 in Client Security
Summary
by MITRE
SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 2004, Norton Personal Firewall 2003 and 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 and 1.1 allow remote attackers to cause a denial of service (infinite loop) via a TCP packet with (1) SACK option or (2) Alternate Checksum Data option followed by a length of zero.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2025
The vulnerability described in CVE-2004-0375 represents a critical denial of service weakness within Symantec's security suite products including Norton Internet Security 2003 and 2004, Norton Personal Firewall 2003 and 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 and 1.1. This flaw exists in the SYMNDIS.SYS kernel driver component that handles network packet processing for these security applications. The vulnerability specifically targets the handling of TCP packet options within the network filtering mechanism, creating a condition where legitimate network traffic can trigger an infinite loop in the driver's processing logic.
The technical implementation of this vulnerability exploits two distinct TCP packet options that when improperly constructed can cause the kernel driver to enter an infinite loop during packet processing. The first option involves the SACK (Selective Acknowledgment) option with a length parameter set to zero, while the second involves the Alternate Checksum Data option with the same zero-length parameter. Both scenarios create malformed TCP packets that, when processed by the vulnerable SYMNDIS.SYS driver, result in recursive processing loops where the driver continuously processes the same malformed packet without proper termination conditions. This behavior directly violates the principle of bounded execution in network drivers and represents a classic example of improper input validation.
From an operational perspective, this vulnerability presents a significant risk to systems running affected Symantec products as remote attackers can exploit it to cause denial of service conditions without requiring authentication or elevated privileges. The infinite loop condition effectively consumes system resources including cpu cycles and memory, potentially leading to complete system unresponsiveness or crashes. Network administrators face the challenge of maintaining service availability while these systems are vulnerable, as the attack can be executed from any remote location without requiring network access to the target system. The impact extends beyond individual machines to potentially affect entire network segments if multiple vulnerable systems exist within the same network infrastructure, creating cascading denial of service effects.
The vulnerability aligns with CWE-121, which describes improper handling of input data leading to buffer overflow conditions, and specifically relates to CWE-691, which covers insufficient control of a resource through a mechanism that allows uncontrolled resource consumption. From an ATT&CK framework perspective, this vulnerability maps to T1499.004, which covers the use of network denial of service attacks, and T1595.001, which involves network scanning techniques to identify vulnerable systems. The attack vector represents a remote exploitation scenario that requires no special privileges, making it particularly dangerous for enterprise environments where multiple systems may be running the vulnerable software. Organizations should consider implementing network segmentation and monitoring to detect anomalous packet patterns that may indicate exploitation attempts.
Mitigation strategies for this vulnerability include immediate patching of affected Symantec products to address the kernel driver processing logic. System administrators should also implement network-based monitoring solutions to detect malformed TCP packets with zero-length options and consider implementing intrusion detection systems that can identify and block such traffic patterns. Additionally, organizations should perform comprehensive vulnerability assessments to identify all systems running affected Symantec products and ensure that proper network access controls are in place to limit exposure to external threats. The vulnerability demonstrates the critical importance of proper input validation in kernel-level network drivers and serves as a reminder of the potential for seemingly benign network protocol options to create serious security implications when not properly handled by security software implementations.