|
Symantec Products CAB and RAR Archive Handling Vulnerabilities
|
|
Secunia Advisory:
|
SA26053
|
|
|
Release Date:
|
2007-07-12
|
|
Last Update:
|
2007-07-19
|
|
Popularity:
|
17,370 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Symantec Gateway Security 5000 Series 3.x
Symantec Gateway Security 5400 Series 2.x
|
|
| Software: | Symantec AntiVirus Corporate Edition 10.x
Symantec AntiVirus Corporate Edition 9.x
Symantec AntiVirus Corporate Edition for Linux
Symantec AntiVirus for Macintosh 10.x
Symantec AntiVirus for Network Attached Storage 4.x
Symantec AntiVirus Scan Engine 4.x
Symantec AntiVirus/Filtering for Domino 3.x
Symantec Brightmail AntiSpam 4.x
Symantec Brightmail AntiSpam 5.x
Symantec Brightmail AntiSpam 6.x
Symantec Client Security 2.x
Symantec Client Security 3.x
Symantec Mail Security for Domino 4.x
Symantec Mail Security for Domino 5.x
Symantec Mail Security for Exchange 4.x
Symantec Mail Security for Microsoft Exchange 5.x
Symantec Mail Security for Microsoft Exchange 6.x
Symantec Mail Security for SMTP 5.x
Symantec Norton AntiVirus 2004
Symantec Norton AntiVirus 2005
Symantec Norton AntiVirus 2006
Symantec Norton AntiVirus for Macintosh 10.x
Symantec Norton AntiVirus for Macintosh 9.x
Symantec Norton Internet Security 2004
Symantec Norton Internet Security 2004 Professional
Symantec Norton Internet Security 2005
Symantec Norton Internet Security 2006
Symantec Norton Internet Security for Macintosh 3.x
Symantec Norton Personal Firewall 2006
Symantec Norton SystemWorks 2004
Symantec Norton SystemWorks 2005
Symantec Norton SystemWorks 2006
Symantec Norton SystemWorks for Macintosh 3.x
Symantec Scan Engine 5.x
Symantec Web Security 3.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2007-3699
CVE-2007-0447
CVE-2007-3801
CVE-2007-3802
|
|
Description:
Two vulnerabilities have been reported in various Symantec products, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.
1) A boundary error within the Symantec Decomposer component when handling CAB archives can be exploited to cause a heap corruption via a specially crafted CAB archive.
Successful exploitation may allow execution of arbitrary code.
2) An input validation error within the Symantec Decomposer component when handling RAR archives can be exploited to cause an infinite loop via a RAR archive with a specially crafted header containing a forged PACK_SIZE field.
The vulnerabilities are reported in the following products and versions:
* Symantec Mail Security 8200 (all builds)
* Symantec Mail Security for Microsoft Exchange versions 4.6.3 and prior, 5.0.0.204, and 6.0.0 (all builds)
* Symantec Mail Security for Domino NT versions 4.1.4 and prior and 5.0.0.47 (all builds)
* Symantec AntiVirus/Filtering for Domino MPE(AIX, Linux, Solaris) versions 3.0.12 and prior (all builds)
* Symantec Scan Engine version 5.0.1 and prior (all builds)
* Symantec AntiVirus Scan Engine versions 4.1.8 and prior and 4.3.12 and prior (all builds)
* Symantec AntiVirus Scan Engine for MS ISA versions 4.3.12 and prior (all builds)
* Symantec AntiVirus Scan Engine for MS Sharepoint versions 4.3.12 and prior (all builds)
* Symantec AntiVirus Scan Engine for Messaging versions 4.3.12 and prior (all builds)
* Symantec AntiVirus for Network Attached Storage versions 4.3.12 and prior (all builds)
* Symantec AntiVirus Scan Engine for Clearswift versions 4.3.12 and prior (all builds)
* Symantec AntiVirus Scan Engine for Caching versions 4.3.12 and prior (all builds)
* Symantec Client Security versions 3.0, 3.x, and 2.x (all builds)
* Symantec Web Security versions 3.0.1.76 and prior (all builds)
* Symantec Gateway Security 5000 Series version 3.01 (all builds)
* Symantec Gateway Security 5400 Series version 2.0.1 (all builds)
* Symantec Brightmail AntiSpam versions 6.0.x, 5.5, and 4.x (all builds)
* Symantec AntiVirus Corporate Edition versions 10.1, 10.0, and 9.0 (10.1.5.5000 and prior and 9.0.6.1000 and prior)
* Symantec AntiVirus Corperate Edition for Linux
* Symantec AntiVirus for Macintosh version 10.x (all builds)
* Symantec Web Security for Microsoft ISA 2004 version 5.0 (all builds)
* Symantec Mail Security for SMTP version 5.0.0 (Windows/Linux/Solaris) and 5.0.1 (all builds)
* Norton AntiVirus 2004/2005/2006
* Norton Internet Security 2004/2005/2005.5 AntiSpyware Edition/2006
* Norton SystemWorks 2004/2005/2006
* Norton Personal Firewall 2006
* Norton AntiVirus for Macintosh versions 9.x and 10.x
* Norton Internet Security for Macintosh version 3.x
* Norton SystemWorks for Macintosh version 3.x
Solution:
Apply updates or run LiveUpdate. Please see the vendor's advisory for details.
Provided and/or discovered by:
Discovered by an anonymous person and reported via ZDI.
Changelog:
2007-07-13: Updated "Description" section, added additional links and CVE references.
2007-07-19: Added CVE reference.
Original Advisory:
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11f.html
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-039.html
http://www.zerodayinitiative.com/advisories/ZDI-07-040.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
