Secunia Logo  


Secunia PSI WorldMap
 
Symantec Multiple Products UPX Parsing Engine Buffer Overflow
Secunia Advisory: SA14179
Release Date: 2005-02-09
Last Update: 2005-02-11
Popularity: 38,805 views

Critical:
Highly critical
Impact: System access
Where: From remote
Solution Status: Vendor Patch

OS:Symantec Gateway Security 1.x
Symantec Gateway Security 2.x

Software:Symantec AntiVirus Corporate Edition 8.x
Symantec AntiVirus Corporate Edition 9.x
Symantec AntiVirus for Caching 4.x
Symantec AntiVirus for Network Attached Storage 4.x
Symantec AntiVirus for SMTP Gateways 3.x
Symantec AntiVirus Scan Engine 4.x
Symantec AntiVirus/Filtering for Domino 3.x
Symantec Brightmail AntiSpam 4.x
Symantec Brightmail AntiSpam 5.x
Symantec Client Security 1.x
Symantec Client Security 2.x
Symantec Mail Security for Exchange 4.x
Symantec Mail Security for SMTP 4.x
Symantec Norton AntiVirus 2004
Symantec Norton AntiVirus for Microsoft Exchange 2.x
Symantec Norton Internet Security 2004
Symantec Norton Internet Security 2004 Professional
Symantec Norton SystemWorks 2004
Symantec Web Security 3.x

Secunia CVSS-2 Score: Available in Secunia business solutions

Subscribe: Instant alerts on relevant vulnerabilities


Advisory Content (Page 1 of 3)[ 1 ] [ 2 ] [ 3 ]

Description:
ISS X-Force has reported a vulnerability in multiple Symantec products, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the DEC2EXE parsing engine used by the antivirus scanning functionality when processing UPX compressed files. This can be exploited to cause a heap-based buffer overflow via a specially crafted UPX file.

Successful exploitation allows execution of arbitrary code.

The vulnerability affects the following products:
* Norton AntiVirus for Microsoft Exchange 2.1 (prior to build 2.18.85)
* Symantec Mail Security for Microsoft Exchange 4.0 (prior to build 4.0.10.465)
* Symantec Mail Security for Microsoft Exchange 4.5 (prior to build 4.5.3)
* Symantec AntiVirus/Filtering for Domino NT 3.1 (prior to build 3.1.1)
* Symantec Mail Security for Domino 4.0 (prior to build 4.0.1)
* Symantec AntiVirus/Filtering for Domino Ports 3.0 for AIX (prior to build 3.0.6)
* Symantec AntiVirus/Filtering for Domino Ports 3.0 for OS400, Linux, Solaris (prior to build 3.0.7)
* Symantec AntiVirus Scan Engine 4.3 (prior to build 4.3.3)
* Symantec AntiVirus for Network Attached Storage (prior to build 4.3.3)
* Symantec AntiVirus for Caching (prior to build 4.3.3)
* Symantec AntiVirus for SMTP 3.1 (prior to build 3.1.7)
* Symantec Mail Security for SMTP 4.0 (prior to build 4.0.2)
* Symantec Web Security 3.0 (prior to build 3.0.1.70)
* Symantec BrightMail AntiSpam 4.0
* Symantec BrightMail AntiSpam 5.5
* Symantec AntiVirus Corporate Edition 9.0 (prior to build 9.01.1000)
* Symantec AntiVirus Corporate Edition 8.01, 8.1.1
* Symantec Client Security 2.0 (prior to build 9.01.1000)
* Symantec Client Security 1.0
* Symantec Gateway Security 2.0, 2.0.1 - 5400 Series
* Symantec Gateway Security 1.0 - 5300 Series
* Symantec Norton Antivirus 2004 for Windows
* Symantec Norton Internet Security 2004 (pro) for Windows
* Symantec Norton System Works 2004 for Windows
* Symantec Norton Antivirus 2004 for Macintosh
* Symantec Norton Internet Security 2004 for Macintosh
* Symantec Norton System Works 2004 for Macintosh
* Symantec Norton Antivirus 9.0 for Macintosh
* Symantec Norton Internet Security for Macintosh 3.0
* Symantec Norton System Works for Macintosh 3.0

Change Page:
[ 1 ] [ 2 ] [ 3 ]



Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.

Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  
Latest Advisories

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.

Most Popular - 3 Hours

1. Sun Java JDK / JRE Multiple Vulnerabilities // 29 views
2. Internet Explorer Charset Inheritance Cross-Site Scripting Vulnerability // 27 views
3. Adobe Flash Player Multiple Vulnerabilities // 21 views
4. Internet Explorer 7 Window Injection Vulnerability // 20 views
5. Adobe Reader/Acrobat Multiple Vulnerabilities // 20 views
6. RSA Products XML Signature HMAC Truncation Spoofing // 16 views
7. Linux Kernel Multiple Vulnerabilities // 15 views
8. Oracle Products Multiple Vulnerabilities // 14 views
9. Microsoft Windows Win32k Kernel-Mode Driver Multiple Vulnerabilities // 13 views
10. Mono XML Signature HMAC Truncation Spoofing // 13 views