Secunia

A vulnerability has been reported in AhnLab products, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

The vulnerability is caused due to an input validation error in the AhnLab V3 Engine when handling the filename length field in a ZIP archive. This can be exploited to overwrite an arbitrary, although limited, memory location with a NULL byte via a specially crafted ZIP archive.

The vulnerability affects the following products:
* AhnLab V3 Pro 2004
* AhnLab V3 Internet Security 2007

Solution
Update to versions later than V3 Engine 2007.11.08.00. The vendor recommends updating to the latest V3 Engine via Smart Update.

Provided and/or discovered by
Reported by the vendor and independently discovered by Sowhat, Nevis Labs.

Changelog
Further details available in Customer Area

Original Advisory
AhnLab:
http://global.ahnlab.com/global/notice_view.ESD?fmethod=view&press_seq=803&printNum=2

Nevis Labs:
http://secway.org/advisory/AD20071116.txt

Deep Links
Links available in Customer Area