Secunia

Sergio Alvarez has reported some vulnerabilities in the NOD32 Antivirus engine, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

1) An integer-overflow error within the parsing of DOC files can be exploited to cause a heap-based buffer overflow via a specially crafted DOC file.

Successful exploitation allows execution of arbitrary code.

2) An integer-overflow error within the parsing of CAB archives can be exploited to cause a heap-based buffer overflow via a specially crafted CAB archive.

Successful exploitation allows execution of arbitrary code.

3) A division-by-zero error within the parsing of CHM files can be exploited to cause a DoS via a specially crafted CHM file.

The vulnerabilities are reported in versions prior to 1.1743.

Solution
Update to the latest version.

Provided and/or discovered by
Sergio Alvares, n.runs AG.

Changelog
Further details available in Customer Area

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051379.html
http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051392.html

Deep Links
Links available in Customer Area