Avira Antivir中.LZH文件时存在缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1190382 漏洞类型 缓冲区溢出
发布时间 2007-05-31 更新时间 2007-06-12
CVE编号 CVE-2007-2974 CNNVD-ID CNNVD-200705-583
漏洞平台 N/A CVSS评分 10.0
|漏洞来源
https://cxsecurity.com/issue/WLB-2007060026
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200705-583
|漏洞详情
AviraAntiVir中文名为小红伞,是一款德国的杀毒软件。AviraAntiVir的扫描引擎解析恶意的.LZH文件时存在缓冲区溢出,本地或远程攻击者通过诱使用户解析处理恶意LZH文件在用户机器上执行任意指令。
|漏洞EXP
n.runs AG					   
http://www.nruns.com/			              security(at)nruns.com
n.runs-SA-2007.010                                           28-May-2007
________________________________________________________________________

Vendor:	           Avira GmbH, http://www.avira.com
Affected Product:      Avira Antivir Antivirus
Vulnerability:         Arbitrary Code Execution (remote) 
Risk:                  HIGH
________________________________________________________________________

Vendor communication:

2007/05/07		initial notification to Avira GmbH
  2007/05/07		Avira GmbH Response
  2007/05/08		PGP public keys exchange
  2007/05/09		PoC files sent to Avira GmbH
  2007/05/10		Avira GmbH acknowledged and validated the PoC files
  2007/05/16		Avira GmbH sent fix release schedule and fixed
engine
  2007/05/17		Sergio Alvarez tested fixed engine
  2007/05/23		Avira GmbH released Update with fixes
________________________________________________________________________

Overview:
 
Avira, a company with over 15 millions customers and more than 250 employees
is a worldwide leading supplier of self-developed security solutions for
professional and private use. With more than 20 years of experience, the
company is one of the pioneers in this field.
In addition to programs specifically for use on single workstations, Avira
primarily offers professional solutions for cross-system protection of
networks on various levels. These include products for workstations, file,
mail and web servers. Gateway computers can be managed as workstation
computers via a central management console for all operating systems. In
addition to the management products of the individual solutions, security
programs for PDAs, smartphones and embedded devices are also offered.
Avira AntiVir Personal, used by millions of private users, represents a
significant contribution to security.

Description:

A remotely exploitable vulnerability has been found in the file parsing
engine.

In detail, the following flaw was determined:

- Buffer Overflow through Integer Cast Around in .LZH file parsing

Impact:

This problem can lead to remote arbitrary code execution if an attacker
carefully crafts a file that exploits the aforementioned vulnerability. The
vulnerability is present in Avira Antivir Antivirus software versions prior
to the update Version 7.03.00.09.

Solution: 
The vulnerability was reported on 07.May.2007 and an update has been issued
on 23.May.2007 to solve this vulnerability through the regular update
mechanism.
________________________________________________________________________

Credit: 
Bugs found by Sergio Alvarez of n.runs AG. 
________________________________________________________________________

References: 
http://forum.antivir-pe.de/thread.php?threadid=22528

This Advisory and Upcoming Advisories:
http://www.nruns.com/security_advisory.php
________________________________________________________________________

Unaltered electronic reproduction of this advisory is permitted. For all
other reproduction or publication, in printing or otherwise, contact
security (at) nruns (dot) com [email concealed] for permission. Use of the advisory constitutes
acceptance for use in an "as is" condition. All warranties are excluded. In
no event shall n.runs be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages, even if n.runs has been advised of the possibility of such damages.

Copyright 2007 n.runs AG. All rights reserved. Terms of apply.
|参考资料

来源:BID
名称:24187
链接:http://www.securityfocus.com/bid/24187
来源:MISC
链接:http://www.nruns.com/advisories/%5Bn.runs-SA-2007.010%5D%20-%20Avira%20Antivir%20Antivirus%20LZH%20parsing%20Arbitrary%20Code%20Execution%20Advisory.txt
来源:VUPEN
名称:ADV-2007-1971
链接:http://www.frsirt.com/english/advisories/2007/1971
来源:SECUNIA
名称:25417
链接:http://secunia.com/advisories/25417
来源:forum.antivir-pe.de
链接:http://forum.antivir-pe.de/thread.php?threadid=22528
来源:BUGTRAQ
名称:20070528n.runs-SA-2007.010-AviraAntivirAntivirusLZHparsingArbitraryCodeExecutionAdvisory
链接:http://www.securityfocus.com/archive/1/archive/1/469805/100/0/threaded
来源:SECTRACK
名称:1018131
链接:http://securitytracker.com/id?1018131
来源:OSVDB
名称:36712
链接:http://osvdb.org/36712
来源:XF
名称:avira-antivir-lzh-bo(34551)
链接:http://xforce.iss.net/xforce/xfdb/34551
来源:SREASON
名称:2764
链接:http://securityreason.com/securityalert/2764
来源:FULLDISC
名称:20070528n.runs-SA-2007.010-AviraAntivirAntivirusLZHparsingArbitraryCodeExecutionAdvisory
链接:http://lists.grok.or