|
Symantec Multiple Products UPX Parsing Engine Buffer Overflow
|
|
Secunia Advisory:
|
SA14179
|
|
|
Release Date:
|
2005-02-09
|
|
Last Update:
|
2005-02-11
|
|
Popularity:
|
36,046 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Symantec Gateway Security 1.x
Symantec Gateway Security 2.x
|
|
| Software: | Symantec AntiVirus Corporate Edition 8.x
Symantec AntiVirus Corporate Edition 9.x
Symantec AntiVirus for Caching 4.x
Symantec AntiVirus for Network Attached Storage 4.x
Symantec AntiVirus for SMTP Gateways 3.x
Symantec AntiVirus Scan Engine 4.x
Symantec AntiVirus/Filtering for Domino 3.x
Symantec Brightmail AntiSpam 4.x
Symantec Brightmail AntiSpam 5.x
Symantec Client Security 1.x
Symantec Client Security 2.x
Symantec Mail Security for Exchange 4.x
Symantec Mail Security for SMTP 4.x
Symantec Norton AntiVirus 2004
Symantec Norton AntiVirus for Microsoft Exchange 2.x
Symantec Norton Internet Security 2004
Symantec Norton Internet Security 2004 Professional
Symantec Norton SystemWorks 2004
Symantec Web Security 3.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-0249
|
|
Description:
ISS X-Force has reported a vulnerability in multiple Symantec products, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to a boundary error in the DEC2EXE parsing engine used by the antivirus scanning functionality when processing UPX compressed files. This can be exploited to cause a heap-based buffer overflow via a specially crafted UPX file.
Successful exploitation allows execution of arbitrary code.
The vulnerability affects the following products:
* Norton AntiVirus for Microsoft Exchange 2.1 (prior to build 2.18.85)
* Symantec Mail Security for Microsoft Exchange 4.0 (prior to build 4.0.10.465)
* Symantec Mail Security for Microsoft Exchange 4.5 (prior to build 4.5.3)
* Symantec AntiVirus/Filtering for Domino NT 3.1 (prior to build 3.1.1)
* Symantec Mail Security for Domino 4.0 (prior to build 4.0.1)
* Symantec AntiVirus/Filtering for Domino Ports 3.0 for AIX (prior to build 3.0.6)
* Symantec AntiVirus/Filtering for Domino Ports 3.0 for OS400, Linux, Solaris (prior to build 3.0.7)
* Symantec AntiVirus Scan Engine 4.3 (prior to build 4.3.3)
* Symantec AntiVirus for Network Attached Storage (prior to build 4.3.3)
* Symantec AntiVirus for Caching (prior to build 4.3.3)
* Symantec AntiVirus for SMTP 3.1 (prior to build 3.1.7)
* Symantec Mail Security for SMTP 4.0 (prior to build 4.0.2)
* Symantec Web Security 3.0 (prior to build 3.0.1.70)
* Symantec BrightMail AntiSpam 4.0
* Symantec BrightMail AntiSpam 5.5
* Symantec AntiVirus Corporate Edition 9.0 (prior to build 9.01.1000)
* Symantec AntiVirus Corporate Edition 8.01, 8.1.1
* Symantec Client Security 2.0 (prior to build 9.01.1000)
* Symantec Client Security 1.0
* Symantec Gateway Security 2.0, 2.0.1 - 5400 Series
* Symantec Gateway Security 1.0 - 5300 Series
* Symantec Norton Antivirus 2004 for Windows
* Symantec Norton Internet Security 2004 (pro) for Windows
* Symantec Norton System Works 2004 for Windows
* Symantec Norton Antivirus 2004 for Macintosh
* Symantec Norton Internet Security 2004 for Macintosh
* Symantec Norton System Works 2004 for Macintosh
* Symantec Norton Antivirus 9.0 for Macintosh
* Symantec Norton Internet Security for Macintosh 3.0
* Symantec Norton System Works for Macintosh 3.0
Solution:
Updates are available (see the vendor advisory for details).
Provided and/or discovered by:
Alex Wheeler, ISS X-Force.
Changelog:
2005-02-10: Added CVE reference.
2005-02-11: Added link to US-CERT vulnerability note.
Original Advisory:
Symantec:
http://www.sarc.com/avcenter/security/Content/2005.02.08.html
ISS X-Force:
http://xforce.iss.net/xforce/alerts/id/187
Other References:
US-CERT VU#107822:
http://www.kb.cert.org/vuls/id/107822
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
