Description: Dr. Peter Bieringer has reported a vulnerability in various AV (Anti Virus) products, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to missing limits in the decompression engine when checking bzip2 files. This can be exploited via overly large files to make an affected product consume large amounts of disk space and CPU resources.
The vulnerability has been reported in the following products:
* Kaspersky Anti-Virus for Linux 5.0.1.0 (probably all versions since 4.5)
* McAfee Virus Scan for Linux 4.16.0
* Trend Micro InterScan Viruswall for Linux 3.6 build 1160 and higher
* Trend Micro InterScan Viruswall for Solaris 3.6 build 1160 and higher
* Trend Micro InterScan Viruswall for Sendmail Switch 3.6 + Patch 2
* Trend Micro InterScan Viruswall for Linux 3.8
* Trend Micro InterScan Viruswall for Solaris 3.8
* Trend Micro InterScan Viruswall for AIX 3.6
* Trend Micro InterScan Viruswall for HP-UX 3.6
Other versions and products may also be affected.
Solution: Filter bzip2 files.
Trend Micro recommends system administrators to set an extraction limit ("extract_limit_size") in the "/etc/iscan/intscan.ini" file.
Provided and/or discovered by: Dr. Peter Bieringer
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
