|
Sophos Anti-Virus RAR and CHM Denial of Service Vulnerabilities
|
|
Secunia Advisory:
|
SA22591
|
|
|
Release Date:
|
2006-10-30
|
|
Last Update:
|
2006-12-11
|
|
Popularity:
|
8,114 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Sophos Anti-Virus 4.x
Sophos Anti-Virus 5.x
Sophos Anti-Virus for Windows 6.x
Sophos Anti-Virus Small Business Edition
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-5645
CVE-2006-5646
CVE-2006-5647
|
|
Description:
Some vulnerabilities have been reported in Sophos Anti-Virus, which can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise a vulnerable system.
1) An error in the AntiVirus engine when processing RAR archives with "heap_size" and "pack_size" fields set to 0 in the Archive Header section can be exploited to make the engine enter into an infinite loop and stop scanning other files.
2) An error in the AntiVirus engine when processing CHM files with "Window_size" field set to 0 in the LZX decompression header can be exploited to cause a heap-based buffer overflow.
3) An error in the AntiVirus engine when processing CHM files with a large name length specified in the the CHM chunk header can be exploited to cause a memory corruption and may lead to execution of arbitrary code.
Please see the vendor's advisory for a list of affected versions.
Solution:
Update to the latest version.
Provided and/or discovered by:
1) Titon, BastardLabs, Damian Put, and an anonymous researcher.
2, 3) Damian Put
Changelog:
2006-11-02: Added CVE reference.
2006-12-11: Updated various sections to include additional information from iDefense.
Original Advisory:
Sophos:
http://www.sophos.com/support/knowledgebase/article/7609.html
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=439
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=452
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=451
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
