Onderwerp: Symantec Antivirus Library Remote Heap Overflows

Date
December 20, 2005

Vulnerability
The Symantec Antivirus Library provides file format support for virus ana=
lysis. During decompression of RAR files Symantec is vulnerable to multip=
le heap overflows allowing attackers complete control of the system(s) be=
ing protected. These vulnerabilities can be exploited remotely without us=
er interaction in default configurations through common protocols such as=
SMTP.

Impact
Successful exploitation of Symantec protected systems allows attackers un=
authorized control of data and related privileges. It also provides lever=
age for further network compromise. Symantec implementations are likely v=
ulnerable in their default configuration. In default configurations users=
are likely vulnerable regardless of whether they choose to open or read =
the email.

Affected Products
Due to the library=E2=80=99s modular design and core functionality; it is=
likely this vulnerability affects a substantial portion of Symantec=E2=80=
=99s gateway, server, & client antivirus-enabled product lines on most pl=
atforms. In fact, the scope of this vulnerability is likely similar to th=
e one described in the following link and also includes more current vers=
ions.

http://xforce.iss.net/xforce/alerts/id/187

Further, this library is also licensed to a substantial number of venders=
with products/services that are likely affected. A small sample of these=
vendors can be found in the following link.

http://www.symantec.com/partners/index.html

Recommendation
Disable scanning of RAR compressed files until the vulnerable code is fix=
ed.

Credit
This vulnerability was discovered and researched by Alex Wheeler.

Contact
security@rem0te.com

Looking at this post it seems this is a new advisory but the links from iss.net show this to be Feb 2005. Is this new or not?