Remote stack buffer overflow in Symantec Messaging Gateway enables root code execution

A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root.

• The CNA/NVD data identifies Symantec Messaging Gateway on Linux as affected from version 0 through and including 10.5; the default status outside the listed range is unaffected.
• The Exodus Intelligence advisory describes the affected boundary as 9.5 and before, which conflicts with the 10.5 boundary in the CNA/NVD data. Because the broader structured boundary is recorded in the CVE data, use 10.5 and before for initial triage, then verify the installed release against the product source.
• The advisory also describes the product as end-of-life. No exact fixed release is confirmed in the record or in the sources reviewed.

Symantec Messaging Gateway contains a stack buffer overflow in the libdec2lha.so library. Attacker-controlled data can trigger the flaw while the service processes network requests, but the available evidence does not identify the specific protocol field, message, or function that causes the overflow. The vulnerability is remotely reachable by an anonymous attacker without prior privileges or user interaction, and code execution occurs with root privileges. Public detail does not establish the exact configuration, listening service, or data sequence required to trigger the flaw.

The vulnerability is reachable over the network and does not require authentication, prior privileges, or user interaction. The recorded assessment describes low attack complexity. The normalized record does not confirm exploitation in the wild and marks public_exploit as false; the CISA enrichment contained in the returned data records exploitation as none, but that does not prove that exploitation has never occurred in every environment. A public advisory exists, but the evidence reviewed does not contain a reusable payload, exploit procedure, or public exploit implementation.

The flaw enables remote code execution with root privileges on the system running Symantec Messaging Gateway. Because the attacker does not need authentication or user interaction, a deployment reachable from an untrusted network may be compromised without a valid account. Technical consequences can include reading or modifying data, changing configuration, interfering with processes, and disrupting service. The extent of further access depends on the gateway's connections, permissions, and network segmentation; the available evidence does not confirm a specific path to other systems.

• Host control: Code execution as root could allow an attacker to alter software, configuration, and data on the system running the gateway.
• Data confidentiality and integrity: Depending on the deployment's permissions and connections, an attacker may be able to access or modify data handled by the gateway.
• Service disruption: Control of the process or host could cause service stoppage, unstable message processing, or loss of availability.
• Limit: The evidence confirms root-level code execution capability, but does not confirm a breach, a named victim, specific data theft, or a particular exploitation campaign.

1. Prioritize removal or replacement: The reviewed advisory states that Symantec Messaging Gateway is end-of-life and that no patches are available. Plan migration to a supported product or retire deployments within the affected range.
2. Verify patch status: The normalized record marks patch_available as true but provides no solution or exact fixed release. Do not treat that flag as evidence of a confirmed corrective release; verify directly with the product source before deploying a change.
3. Reduce exposure during transition: If immediate removal is not possible, restrict access from untrusted networks and apply appropriate network access controls. This is a general precaution, not a vendor-confirmed mitigation described in the available evidence.
4. Validate each deployment branch: Compare each system's version, platform, and network role with the 0 through 10.5 range in Affected Summary. Do not infer that unlisted later or parallel branches are unaffected.

1. Inventory every server or appliance running Symantec Messaging Gateway, including its installed version, platform, and network location.
2. Compare installed versions with the affected boundary in Affected Summary; do not treat the absence of an alert as proof that a system is safe.
3. Confirm whether deployments use libdec2lha.so and identify which services can receive network data. The available evidence does not identify a specific endpoint or message format.
4. Review logs and telemetry for process crashes, unexpected restarts, or abnormal service behavior as general defensive signals, not as confirmed indicators of compromise.
5. Identify deployments that can accept anonymous connections from untrusted networks. No specific IOC or distinctive log event is provided by the available evidence.