Sophos Antivirus Library Remote Heap Overflow

[list@rem0te.com]

Date
August 26, 2005

Vulnerability
The Sophos Antivirus Library provides file format support for virus analy=
sis. During analysis of Visio files Sophos is vulnerable to a heap overfl=
ow allowing attackers complete control of the system(s) being protected. =
This vulnerability can be exploited remotely without user interaction or =
authentication through common protocols such as SMTP, SMB, HTTP, FTP, etc=
..

Impact
Successful exploitation of Sophos protected systems allows attackers unau=
thorized control of data and related privileges. It also provides leverag=
e for further network compromise. Sophos Antivirus Library implementation=
s are likely vulnerable in their default configuration.

Affected Products
Sophos Antivirus for Windows 2000/XP/2003
Sophos Antivirus for Windows NT
Sophos Antivirus for Mac OS X
Sophos Antivirus for MAC 8/9
Sophos Antivirus for UNIX/Linux
Sophos Antivirus for Netware
Sophos Antivirus for OS/2
Sophos Antivirus for OpenVMS
Sophos Antivirus for DOS/Windows 3.1x
Sophos Antivirus Small Business Edition for Windows
Sophos Antivirus Small Business Edition for Mac
PureMessage Small Business Edition
PureMessage for Windows/Exchange
PureMessage for UNIX
MailMonitor for SMTP =E2=80=93 Windows
MailMonitor for Notes/Domino
MailMonitor for Exchange

The Sophos Antivirus Library is also OEM by over 25 other vendors with pr=
oducts that are affected by this vulnerability; see the following link fo=
r a list. There are also several vendors not listed that OEM the Sophos A=
ntivirus Library. Refer to Sophos or your vendor for specifics.

http://www.sophos.com/partners/oem/

Credit
This vulnerability was discovered and researched by Alex Wheeler.

Contact
security@rem0te.com

Details
http://www.rem0te.com/public/images/sophos.pdf

[Dowling, Gabrielle]

Sophos has had a fix for since August 5th=2E=2E=2E=0D=0Ahttp://www=2Esophos=
=2Ecom/support/knowledgebase/article/3409=2Ehtmlj=2E The=0D=0Avulnerabilit=
y was also publicly discussed prior to that time=2E =0D=0A=0D=0AG=0D=0A=0D=
=0A-----Original Message-----=0D=0AFrom: list@rem0te=2Ecom [mailto:list@rem=
0te=2Ecom] =0D=0ASent: Friday, August 26, 2005 8:36 AM=0D=0ATo: full-disclo=
sure@lists=2Egrok=2Eorg=2Euk; bugtraq@securityfocus=2Ecom=0D=0ASubject: Sop=
hos Antivirus Library Remote Heap Overflow=0D=0A=0D=0A=0D=0ADate=0D=0AAugus=
t 26, 2005=0D=0A=0D=0AVulnerability=0D=0AThe Sophos Antivirus Library provi=
des file format support for virus=0D=0Aanalysis=2E During analysis of Visio=
files Sophos is vulnerable to a heap=0D=0Aoverflow allowing attackers comp=
lete control of the system(s) being=0D=0Aprotected=2E This vulnerability ca=
n be exploited remotely without user=0D=0Ainteraction or authentication thr=
ough common protocols such as SMTP,=0D=0ASMB, HTTP, FTP, etc=2E =0D=0A=0D=
=0AImpact=0D=0ASuccessful exploitation of Sophos protected systems allows a=
ttackers=0D=0Aunauthorized control of data and related privileges=2E It als=
o provides=0D=0Aleverage for further network compromise=2E Sophos Antivirus=
Library=0D=0Aimplementations are likely vulnerable in their default config=
uration=2E=0D=0A=0D=0AAffected Products=0D=0ASophos Antivirus for Windows 2=
000/XP/2003=0D=0ASophos Antivirus for Windows NT=0D=0ASophos Antivirus for =
Mac OS X=0D=0ASophos Antivirus for MAC 8/9=0D=0ASophos Antivirus for UNIX/L=
inux=0D=0ASophos Antivirus for Netware=0D=0ASophos Antivirus for OS/2=0D=0A=
Sophos Antivirus for OpenVMS=0D=0ASophos Antivirus for DOS/Windows 3=2E1x=
=0D=0ASophos Antivirus Small Business Edition for Windows=0D=0ASophos Antiv=
irus Small Business Edition for Mac=0D=0APureMessage Small Business Edition=
=0D=0APureMessage for Windows/Exchange=0D=0APureMessage for UNIX=0D=0AMail=
Monitor for SMTP - Windows=0D=0AMailMonitor for Notes/Domino=0D=0AMailMonit=
or for Exchange=0D=0A=0D=0AThe Sophos Antivirus Library is also OEM by over=
25 other vendors with=0D=0Aproducts that are affected by this vulnerabilit=
y; see the following link=0D=0Afor a list=2E There are also several vendors=
not listed that OEM the=0D=0ASophos Antivirus Library=2E Refer to Sophos o=
r your vendor for specifics=2E=0D=0A=0D=0Ahttp://www=2Esophos=2Ecom/partner=
s/oem/=0D=0A=0D=0ACredit=0D=0AThis vulnerability was discovered and researc=
hed by Alex Wheeler=2E=0D=0A=0D=0AContact=0D=0Asecurity@rem0te =2Ecom =0D=0A=
=0D=0ADetails=0D=0Ahttp://www=2Erem0te=2Ecom/public/images/sophos=2Epdf=0D=
=0A=0D=0A=0D=0A=0D=0A-----------------------------------------=0D=0AThis e-=
mail is sent by a law firm and contains information that may be=0D=0Aprivil=
eged and confidential=2E If you are not the intended recipient,=0D=0Aplease=
delete the e-mail and notify us immediately=2E=0D=0A

[list@rem0te.com]

You are partially correct. Prior to this advisory, Sophos & rem0te agreed=
to w/hold details until all fixes were available (August 26th). The Soph=
os link you provided below does not disclose any details of the vulnerabi=
lity - only the patch - which leaves a lot of people guessing about the a=
ctual vulnerability details.

It's also important to note there are many large 3rd party vendors that s=
ublicense this library who should apply patches to their customer install=
ations. It will be interesting to see how many of these 3rd parties issue=
advisories to their users.

> -----Original Message-----
> From: Dowling, Gabrielle [mailto:dowlingg@sullcrom.com]
> Sent: Saturday, August 27, 2005 05:09 AM
> To: list@rem0te.com, full-disclosure@lists.grok.org.uk,
> bugtraq@securityfocus.com
> Subject: RE: Sophos Antivirus Library Remote Heap Overflow
>
> Sophos has had a fix for since August 5th...
> http://www.sophos.com/support/knowledgebase/article/3409.htmlj. The
> vulnerability was also publicly discussed prior to that time.
>
> G
>
> -----Original Message-----
> From: list@rem0te.com [mailto:list@rem0te.com]
> Sent: Friday, August 26, 2005 8:36 AM
> To: full-disclosure@lists.grok.org.uk; bugtraq@securityfocus.com
> Subject: Sophos Antivirus Library Remote Heap Overflow
>
>
> Date
> August 26, 2005
>
> Vulnerability
> The Sophos Antivirus Library provides file format support for virus
> analysis. During analysis of Visio files Sophos is vulnerable to a heap=

> overflow allowing attackers complete control of the system(s) being
> protected. This vulnerability can be exploited remotely without user
> interaction or authentication through common protocols such as SMTP,
> SMB, HTTP, FTP, etc.
>
> Impact
> Successful exploitation of Sophos protected systems allows attackers
> unauthorized control of data and related privileges. It also provides
> leverage for further network compromise. Sophos Antivirus Library
> implementations are likely vulnerable in their default configuration.
>
> Affected Products
> Sophos Antivirus for Windows 2000/XP/2003
> Sophos Antivirus for Windows NT
> Sophos Antivirus for Mac OS X
> Sophos Antivirus for MAC 8/9
> Sophos Antivirus for UNIX/Linux
> Sophos Antivirus for Netware
> Sophos Antivirus for OS/2
> Sophos Antivirus for OpenVMS
> Sophos Antivirus for DOS/Windows 3.1x
> Sophos Antivirus Small Business Edition for Windows
> Sophos Antivirus Small Business Edition for Mac
> PureMessage Small Business Edition
> PureMessage for Windows/Exchange
> PureMessage for UNIX
> MailMonitor for SMTP - Windows
> MailMonitor for Notes/Domino
> MailMonitor for Exchange
>
> The Sophos Antivirus Library is also OEM by over 25 other vendors with
> products that are affected by this vulnerability; see the following lin=
k
> for a list. There are also several vendors not listed that OEM the
> Sophos Antivirus Library. Refer to Sophos or your vendor for specifics.=

>
> http://www.sophos.com/partners/oem/
>
> Credit
> This vulnerability was discovered and researched by Alex Wheeler.
>
> Contact
> security@rem0te.com
>
> Details
> http://www.rem0te.com/public/images/sophos.pdf
>
>
>
> -----------------------------------------
> This e-mail is sent by a law firm and contains information that may be
> privileged and confidential. If you are not the intended recipient,
> please delete the e-mail and notify us immediately.
>
>