list@rem0te.com
20/12/05, 17:45
Date
December 20, 2005
Vulnerability
The Symantec Antivirus Library provides file format support for virus ana=
lysis. During decompression of RAR files Symantec is vulnerable to multip=
le heap overflows allowing attackers complete control of the system(s) be=
ing protected. These vulnerabilities can be exploited remotely without us=
er interaction in default configurations through common protocols such as=
SMTP.
Impact
Successful exploitation of Symantec protected systems allows attackers un=
authorized control of data and related privileges. It also provides lever=
age for further network compromise. Symantec implementations are likely v=
ulnerable in their default configuration. In default configurations users=
are likely vulnerable regardless of whether they choose to open or read =
the email.
Affected Products
Due to the library=E2=80=99s modular design and core functionality; it is=
likely this vulnerability affects a substantial portion of Symantec=E2=80=
=99s gateway, server, & client antivirus-enabled product lines on most pl=
atforms. In fact, the scope of this vulnerability is likely similar to th=
e one described in the following link and also includes more current vers=
ions.
http://xforce.iss.net/xforce/alerts/id/187
Further, this library is also licensed to a substantial number of venders=
with products/services that are likely affected. A small sample of these=
vendors can be found in the following link.
http://www.symantec.com/partners/index.html
Recommendation
Disable scanning of RAR compressed files until the vulnerable code is fix=
ed.
Credit
This vulnerability was discovered and researched by Alex Wheeler.
Contact
security@rem0te.com
December 20, 2005
Vulnerability
The Symantec Antivirus Library provides file format support for virus ana=
lysis. During decompression of RAR files Symantec is vulnerable to multip=
le heap overflows allowing attackers complete control of the system(s) be=
ing protected. These vulnerabilities can be exploited remotely without us=
er interaction in default configurations through common protocols such as=
SMTP.
Impact
Successful exploitation of Symantec protected systems allows attackers un=
authorized control of data and related privileges. It also provides lever=
age for further network compromise. Symantec implementations are likely v=
ulnerable in their default configuration. In default configurations users=
are likely vulnerable regardless of whether they choose to open or read =
the email.
Affected Products
Due to the library=E2=80=99s modular design and core functionality; it is=
likely this vulnerability affects a substantial portion of Symantec=E2=80=
=99s gateway, server, & client antivirus-enabled product lines on most pl=
atforms. In fact, the scope of this vulnerability is likely similar to th=
e one described in the following link and also includes more current vers=
ions.
http://xforce.iss.net/xforce/alerts/id/187
Further, this library is also licensed to a substantial number of venders=
with products/services that are likely affected. A small sample of these=
vendors can be found in the following link.
http://www.symantec.com/partners/index.html
Recommendation
Disable scanning of RAR compressed files until the vulnerable code is fix=
ed.
Credit
This vulnerability was discovered and researched by Alex Wheeler.
Contact
security@rem0te.com