SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Security)  >   AntiVir Vendors:   H+BEDV Datentechnik
AntiVir Buffer Overflow in Processing LZH Files Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1018131
SecurityTracker URL:  http://securitytracker.com/id/1018131
CVE Reference:   CVE-2007-2974   (Links to External Site)
Updated:  May 12 2008
Original Entry Date:  May 28 2007
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 7.03.00.09
Description:   A vulnerability was reported in AntiVir. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted '.lzh' file that, when processed by the target user, will trigger a buffer overflow in the file parsing engine and execute arbitrary code on the target system. The code will run with the privileges of the target user.

The vendor was notified on May 7, 2007.

Sergio Alvarez of n.runs AG discovered this vulnerability.

Impact:   A remote user can create a file that, when processed by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued a fixed version (7.03.00.09) on May 23, 2007.

The Avira advisory is available at:

http://forum.antivir-pe.de/thread.php?threadid=22528

Vendor URL:  www.avira.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:   Windows (Any)

Message History:   None.


 Source Message Contents

Date:  Mon, 28 May 2007 16:53:31 +0200
Subject:  n.runs-SA-2007.010 - Avira Antivir Antivirus LZH parsing Arbitrary Code Execution Advisory

n.runs AG					   
http://www.nruns.com/			              security(at)nruns.com
n.runs-SA-2007.010                                           28-May-2007
________________________________________________________________________

Vendor:	           Avira GmbH, http://www.avira.com
Affected Product:      Avira Antivir Antivirus
Vulnerability:         Arbitrary Code Execution (remote) 
Risk:                  HIGH
________________________________________________________________________

Vendor communication:

  2007/05/07		initial notification to Avira GmbH
  2007/05/07		Avira GmbH Response
  2007/05/08		PGP public keys exchange
  2007/05/09		PoC files sent to Avira GmbH
  2007/05/10		Avira GmbH acknowledged and validated the PoC files
  2007/05/16		Avira GmbH sent fix release schedule and fixed
engine
  2007/05/17		Sergio Alvarez tested fixed engine
  2007/05/23		Avira GmbH released Update with fixes
________________________________________________________________________

Overview:
 
Avira, a company with over 15 millions customers and more than 250 employees
is a worldwide leading supplier of self-developed security solutions for
professional and private use. With more than 20 years of experience, the
company is one of the pioneers in this field.
In addition to programs specifically for use on single workstations, Avira
primarily offers professional solutions for cross-system protection of
networks on various levels. These include products for workstations, file,
mail and web servers. Gateway computers can be managed as workstation
computers via a central management console for all operating systems. In
addition to the management products of the individual solutions, security
programs for PDAs, smartphones and embedded devices are also offered.
Avira AntiVir Personal, used by millions of private users, represents a
significant contribution to security.

Description:

A remotely exploitable vulnerability has been found in the file parsing
engine.

In detail, the following flaw was determined:

- Buffer Overflow through Integer Cast Around in .LZH file parsing


Impact:

This problem can lead to remote arbitrary code execution if an attacker
carefully crafts a file that exploits the aforementioned vulnerability. The
vulnerability is present in Avira Antivir Antivirus software versions prior
to the update Version 7.03.00.09. 

Solution: 
The vulnerability was reported on 07.May.2007 and an update has been issued
on 23.May.2007 to solve this vulnerability through the regular update
mechanism.
________________________________________________________________________

Credit: 
Bugs found by Sergio Alvarez of n.runs AG. 
________________________________________________________________________

References: 
http://forum.antivir-pe.de/thread.php?threadid=22528

This Advisory and Upcoming Advisories:
http://www.nruns.com/security_advisory.php
________________________________________________________________________

Unaltered electronic reproduction of this advisory is permitted. For all
other reproduction or publication, in printing or otherwise, contact
security@nruns.com for permission. Use of the advisory constitutes
acceptance for use in an "as is" condition. All warranties are excluded. In
no event shall n.runs be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages, even if n.runs has been advised of the possibility of such damages.


Copyright 2007 n.runs AG. All rights reserved. Terms of apply.

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC