|
Symantec Multiple Products UPX Parsing Engine Buffer Overflow
|
|
|
|
|
Secunia Advisory:
|
SA14179
|
|
|
Release Date:
|
2005-02-09
|
|
Last Update:
|
2005-02-11
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Symantec Gateway Security 1.x
Symantec Gateway Security 2.x
|
| | Software: | Symantec AntiVirus Corporate Edition 8.x
Symantec AntiVirus Corporate Edition 9.x
Symantec AntiVirus for Caching 4.x
Symantec AntiVirus for Network Attached Storage 4.x
Symantec AntiVirus for SMTP Gateways 3.x
Symantec AntiVirus Scan Engine 4.x
Symantec AntiVirus/Filtering for Domino 3.x
Symantec Brightmail AntiSpam 4.x
Symantec Brightmail AntiSpam 5.x
Symantec Client Security 1.x
Symantec Client Security 2.x
Symantec Mail Security for Exchange 4.x
Symantec Mail Security for SMTP 4.x
Symantec Norton AntiVirus 2004
Symantec Norton AntiVirus for Microsoft Exchange 2.x
Symantec Norton Internet Security 2004
Symantec Norton Internet Security 2004 Professional
Symantec Norton SystemWorks 2004
Symantec Web Security 3.x
|
| | CVE reference: | CVE-2005-0249 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
ISS X-Force has reported a vulnerability in multiple Symantec products, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to a boundary error in the DEC2EXE parsing engine used by the antivirus scanning functionality when processing UPX compressed files. This can be exploited to cause a heap-based buffer overflow via a specially crafted UPX file.
Successful exploitation allows execution of arbitrary code.
The vulnerability affects the following products:
* Norton AntiVirus for Microsoft Exchange 2.1 (prior to build 2.18.85)
* Symantec Mail Security for Microsoft Exchange 4.0 (prior to build 4.0.10.465)
* Symantec Mail Security for Microsoft Exchange 4.5 (prior to build 4.5.3)
* Symantec AntiVirus/Filtering for Domino NT 3.1 (prior to build 3.1.1)
* Symantec Mail Security for Domino 4.0 (prior to build 4.0.1)
* Symantec AntiVirus/Filtering for Domino Ports 3.0 for AIX (prior to build 3.0.6)
* Symantec AntiVirus/Filtering for Domino Ports 3.0 for OS400, Linux, Solaris (prior to build 3.0.7)
* Symantec AntiVirus Scan Engine 4.3 (prior to build 4.3.3)
* Symantec AntiVirus for Network Attached Storage (prior to build 4.3.3)
* Symantec AntiVirus for Caching (prior to build 4.3.3)
* Symantec AntiVirus for SMTP 3.1 (prior to build 3.1.7)
* Symantec Mail Security for SMTP 4.0 (prior to build 4.0.2)
* Symantec Web Security 3.0 (prior to build 3.0.1.70)
* Symantec BrightMail AntiSpam 4.0
* Symantec BrightMail AntiSpam 5.5
* Symantec AntiVirus Corporate Edition 9.0 (prior to build 9.01.1000)
* Symantec AntiVirus Corporate Edition 8.01, 8.1.1
* Symantec Client Security 2.0 (prior to build 9.01.1000)
* Symantec Client Security 1.0
* Symantec Gateway Security 2.0, 2.0.1 - 5400 Series
* Symantec Gateway Security 1.0 - 5300 Series
* Symantec Norton Antivirus 2004 for Windows
* Symantec Norton Internet Security 2004 (pro) for Windows
* Symantec Norton System Works 2004 for Windows
* Symantec Norton Antivirus 2004 for Macintosh
* Symantec Norton Internet Security 2004 for Macintosh
* Symantec Norton System Works 2004 for Macintosh
* Symantec Norton Antivirus 9.0 for Macintosh
* Symantec Norton Internet Security for Macintosh 3.0
* Symantec Norton System Works for Macintosh 3.0
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, scan using the Network Software Inspector.
Solution:
Updates are available (see the vendor advisory for details).
Provided and/or discovered by:
Alex Wheeler, ISS X-Force.
Changelog:
2005-02-10: Added CVE reference.
2005-02-11: Added link to US-CERT vulnerability note.
Original Advisory:
Symantec:
http://www.sarc.com/avcenter/security/Content/2005.02.08.html
ISS X-Force:
http://xforce.iss.net/xforce/alerts/id/187
Other References:
US-CERT VU#107822:
http://www.kb.cert.org/vuls/id/107822
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
43 Related Secunia Security Advisories, displaying 10
|
|
|
1. Symantec Products Symantec Decomposer RAR File Handling Vulnerabilities
|
|
2. Symantec Mail Security Lotus 1-2-3 File Viewer Buffer Overflows
|
|
3. Symantec Mail Security for Exchange File Parsing Vulnerabilities
|
|
4. Symantec Mail Security for SMTP File Parsing Vulnerabilities
|
|
5. Symantec Products Real-Time Scanner Notification Window Privilege Escalation
|
|
6. Symantec Products CAB and RAR Archive Handling Vulnerabilities
|
|
7. Symantec Products SYMTDI.SYS IOCTL Handler Privilege Escalation
|
|
8. Symantec Products Internet Email Auto-Protect Stack Overflow
|
|
9. Norton Personal Firewall ISAlertDataCOM ActiveX Control Buffer Overflow
|
|
10. Symantec Web Security Two Vulnerabilities
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
