Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
Database
Search
Advisories by Product
Advisories by Vendor
Terminology
Report Vulnerability
Insecure Library Loading
Highly critical

Symantec Products CAB and RAR Archive Handling Vulnerabilities

-

Release Date:  2007-07-12    Last Update:  2007-07-19    Views:  26,613

Secunia Advisory SA26053

Where:

From remote

Impact:

DoS, System access

Solution Status:

Vendor Patch

Operating System:

Software:

CVE Reference(s):

Description


Two vulnerabilities have been reported in various Symantec products, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

1) A boundary error within the Symantec Decomposer component when handling CAB archives can be exploited to cause a heap corruption via a specially crafted CAB archive.

Successful exploitation may allow execution of arbitrary code.

2) An input validation error within the Symantec Decomposer component when handling RAR archives can be exploited to cause an infinite loop via a RAR archive with a specially crafted header containing a forged PACK_SIZE field.

The vulnerabilities are reported in the following products and versions:
* Symantec Mail Security 8200 (all builds)
* Symantec Mail Security for Microsoft Exchange versions 4.6.3 and prior, 5.0.0.204, and 6.0.0 (all builds)
* Symantec Mail Security for Domino NT versions 4.1.4 and prior and 5.0.0.47 (all builds)
* Symantec AntiVirus/Filtering for Domino MPE(AIX, Linux, Solaris) versions 3.0.12 and prior (all builds)
* Symantec Scan Engine version 5.0.1 and prior (all builds)
* Symantec AntiVirus Scan Engine versions 4.1.8 and prior and 4.3.12 and prior (all builds)
* Symantec AntiVirus Scan Engine for MS ISA versions 4.3.12 and prior (all builds)
* Symantec AntiVirus Scan Engine for MS Sharepoint versions 4.3.12 and prior (all builds)
* Symantec AntiVirus Scan Engine for Messaging versions 4.3.12 and prior (all builds)
* Symantec AntiVirus for Network Attached Storage versions 4.3.12 and prior (all builds)
* Symantec AntiVirus Scan Engine for Clearswift versions 4.3.12 and prior (all builds)
* Symantec AntiVirus Scan Engine for Caching versions 4.3.12 and prior (all builds)
* Symantec Client Security versions 3.0, 3.x, and 2.x (all builds)
* Symantec Web Security versions 3.0.1.76 and prior (all builds)
* Symantec Gateway Security 5000 Series version 3.01 (all builds)
* Symantec Gateway Security 5400 Series version 2.0.1 (all builds)
* Symantec Brightmail AntiSpam versions 6.0.x, 5.5, and 4.x (all builds)
* Symantec AntiVirus Corporate Edition versions 10.1, 10.0, and 9.0 (10.1.5.5000 and prior and 9.0.6.1000 and prior)
* Symantec AntiVirus Corperate Edition for Linux
* Symantec AntiVirus for Macintosh version 10.x (all builds)
* Symantec Web Security for Microsoft ISA 2004 version 5.0 (all builds)
* Symantec Mail Security for SMTP version 5.0.0 (Windows/Linux/Solaris) and 5.0.1 (all builds)
* Norton AntiVirus 2004/2005/2006
* Norton Internet Security 2004/2005/2005.5 AntiSpyware Edition/2006
* Norton SystemWorks 2004/2005/2006
* Norton Personal Firewall 2006
* Norton AntiVirus for Macintosh versions 9.x and 10.x
* Norton Internet Security for Macintosh version 3.x
* Norton SystemWorks for Macintosh version 3.x


Solution:
Apply updates or run LiveUpdate. Please see the vendor's advisory for details.

Provided and/or discovered by:
Discovered by an anonymous person and reported via ZDI.

Original Advisory:
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11f.html

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-039.html
http://www.zerodayinitiative.com/advisories/ZDI-07-040.html

Deep Links:
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Symantec Products CAB and RAR Archive Handling Vulnerabilities

No posts yet

-

You must be logged in to post a comment.



 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability