Secunia

Secunia Research has discovered a vulnerability in AhnLab V3 Antivirus, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the archive decompression library when reading the filename of a compressed file from an ALZ, UUE or XXE archive. This can be exploited to cause a stack-based buffer overflow (ALZ), or a heap-based buffer overflow (UUE/XXE), when a malicious ALZ/UUE/XXE archive is scanned.

Successful exploitation allows arbitrary code execution, but requires that compressed file scanning is enabled.

The vulnerability has been confirmed in the following products:
* AhnLab V3Pro 2004 (AhnLab V3 VirusBlock 2005 international) (Build 6.0.0.457)
* AhnLab V3Net for Windows Server 6.0 (Build 6.0.0.457)
* AhnLab MyV3 with AzMain.dll 1.3.11.15

Prior versions may also be affected.

Solution
AhnLab V3Pro 2004 (V3 VirusBlock 2005 international):
Further details available in Customer Area

Provided and/or discovered by
Tan Chew Keong, Secunia Research

Original Advisory
AhnLab:
http://global.ahnlab.com/security/security_advisory002.html

Secunia Research:
http://secunia.com/secunia_research/2005-48/advisory/

Deep Links
Links available in Customer Area