Symantec AntiVirus RAR Archive Decompression Buffer Overflow

Secunia Advisory SA18131

Symantec AntiVirus RAR Archive Decompression Buffer Overflow

Secunia Advisory

SA18131

Get alerted and manage the vulnerability life cycle

Release Date

2005-12-20

Last Update

2006-01-30

Popularity

110,354 views

Comments

0 comments

Criticality level

Highly critical

Impact

System access

Where

From remote

Authentication level

Available in Customer Area

Report reliability

Available in Customer Area

Solution Status

Vendor Patch

Systems affected

Available in Customer Area

Approve distribution

Available in Customer Area

Operating System

Symantec Gateway Security 1.x

Symantec Gateway Security 5000 Series 3.x

Symantec Gateway Security 5400 Series 2.x

Software:

Symantec AntiSpam for SMTP

Symantec AntiVirus Corporate Edition 10.x

Symantec AntiVirus for Caching 4.x

Symantec AntiVirus for Clearswift 4.x

Symantec AntiVirus for Handhelds 3.x

Symantec AntiVirus for Microsoft ISA Server 4.x

Symantec AntiVirus for Microsoft SharePoint 4.x

Symantec AntiVirus for Network Attached Storage 4.x

Symantec AntiVirus for SMTP Gateways 3.x

Symantec AntiVirus Scan Engine 4.x

Symantec AntiVirus/Filtering for Domino 3.x

Symantec Brightmail AntiSpam 4.x

Symantec Brightmail AntiSpam 5.x

Symantec Brightmail AntiSpam 6.x

Symantec Client Security 3.x

Symantec Client Security for Nokia Communicator

Symantec Mail Security for Domino 4.x

Symantec Mail Security for Exchange 4.x

Symantec Mail Security for Microsoft Exchange 5.x

Symantec Norton AntiVirus 2004

Symantec Norton AntiVirus 2005

Symantec Norton AntiVirus 2006

Symantec Norton AntiVirus for Macintosh 9.x

Symantec Norton AntiVirus for Microsoft Exchange 2.x

Symantec Norton AntiVirus Solution 7.5

Symantec Norton Internet Security 2004 Professional

Symantec Norton Internet Security 2005

Symantec Norton Internet Security 2006

Symantec Norton Internet Security for Macintosh 3.x

Symantec Norton Personal Firewall 2004

Symantec Norton Personal Firewall 2005

Symantec Norton Personal Firewall 2006

Symantec Norton SystemWorks 2004

Symantec Norton SystemWorks 2005

Symantec Norton SystemWorks 2006

Symantec Norton SystemWorks for Macintosh 3.x

Symantec Scan Engine 5.x

Symantec Web Security 3.x

Secunia CVSS Score

Available in Customer Area

CVE Reference(s)

CVE-2005-4438 CVSS available in Customer Area

Description

Alex Wheeler has reported a vulnerability in Symantec AntiVirus, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in Dec2Rar.dll when copying data based on the length field in the sub-block headers of a RAR archive. This can be exploited to cause a heap-based buffer overflow and may allow arbitrary code execution when a malicious RAR archive is scanned.

The vulnerability has been reported in Dec2Rar.dll version 3.2.14.3 and potentially affects all Symantec products that use the DLL.

Solution
The vendor has issued patches (see patch matrix in vendor advisory).

Provided and/or discovered by
Alex Wheeler

Changelog
Further details available in Customer Area

Original Advisory
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2005.12.21b.html

Alex Wheeler:
http://www.rem0te.com/public/images/symc2.pdf

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Symantec AntiVirus RAR Archive Decompression Buffer Overflow

No posts yet

Secunia

Secunia Advisory SA18131

Symantec AntiVirus RAR Archive Decompression Buffer Overflow

Do you have additional information related to this advisory?

You must be logged in to post a comment.

Secunia Customer Login

Not a customer already?