Alex Wheeler has reported a vulnerability in Symantec AntiVirus, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in Dec2Rar.dll when copying data based on the length field in the sub-block headers of a RAR archive. This can be exploited to cause a heap-based buffer overflow and may allow arbitrary code execution when a malicious RAR archive is scanned.

The vulnerability has been reported in Dec2Rar.dll version 3.2.14.3 and potentially affects all Symantec products that use the DLL.

Solution
The vendor has issued patches (see patch matrix in vendor advisory).

Provided and/or discovered by
Alex Wheeler

Changelog
Further details available to Secunia VIM customers

Original Advisory
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2005.12.21b.html

Alex Wheeler:
http://www.rem0te.com/public/images/symc2.pdf

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers