Secunia

Dr. Peter Bieringer has reported a vulnerability in various AV (Anti Virus) products, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to missing limits in the decompression engine when checking bzip2 files. This can be exploited via overly large files to make an affected product consume large amounts of disk space and CPU resources.

The vulnerability has been reported in the following products:
* Kaspersky Anti-Virus for Linux 5.0.1.0 (probably all versions since 4.5)
* McAfee Virus Scan for Linux 4.16.0
* Trend Micro InterScan Viruswall for Linux 3.6 build 1160 and higher
* Trend Micro InterScan Viruswall for Solaris 3.6 build 1160 and higher
* Trend Micro InterScan Viruswall for Sendmail Switch 3.6 + Patch 2
* Trend Micro InterScan Viruswall for Linux 3.8
* Trend Micro InterScan Viruswall for Solaris 3.8
* Trend Micro InterScan Viruswall for AIX 3.6
* Trend Micro InterScan Viruswall for HP-UX 3.6

Other versions and products may also be affected.

Solution
Filter bzip2 files.
Further details available in Customer Area

Provided and/or discovered by
Dr. Peter Bieringer

Changelog
Further details available in Customer Area

Original Advisory
AERAsec:
http://www.aerasec.de/security/advisories/txt/bzip2bomb-antivirusengines.txt

Trend Micro:
http://kb.trendmicro.com/solutions/solutionDetail.asp?solutionId=18198

Deep Links
Links available in Customer Area