Secunia

André Jerleke has reported a vulnerability in various Symantec AntiVirus products, which can be exploited by malware to bypass certain scanning functionality.

The vulnerability is caused due to an error in the Symantec Antivirus component when processing encoded or archived content. This can be exploited to crash the decomposer component when parsing a specially crafted RAR file.

Successful exploitation causes malware inside the RAR file to bypass the scanning functionality.

This vulnerability primarily poses a risk in environments where virus scanning only is performed on gateway systems, as the malware still is detected by the RealTime Virus Scan / Auto-Protect functionality when extracted on systems running Symantec Antivirus.

Certain Windows builds of the following products are affected:
* Symantec Web Security
* Symantec Mail Security for SMTP
* Symantec AntiVirus Scan Engine
* Symantec SAV/Filter for Domino NT
* Symantec Mail Security for Exchange
* Symantec Norton AntiVirus 2005
* Symantec Norton Internet Security 2005
* Symantec Norton System Works 2005

NOTE: See the vendor advisory for a list of affected and fixed versions.

Solution
Updates are available via LiveUpdate and from the Symantec Support site.
Further details available in Customer Area

Provided and/or discovered by
André Jerleke

Changelog
Further details available in Customer Area

Original Advisory
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2005.04.27.html

Deep Links
Links available in Customer Area