[Full-disclosure] Secunia Research: HAURI Anti-Virus ACE Archive Handling Buffer Overflow

From: Secunia Research (vuln_at_secunia.com)
Date: 08/24/05

  • Next message: Jérôme ATHIAS: "Re: [Full-disclosure] talk.google.com" 
    To: full-disclosure@lists.grok.org.uk
Date: Wed, 24 Aug 2005 10:29:52 +0200

    ======================================================================

                         Secunia Research 24/08/2005

          - HAURI Anti-Virus ACE Archive Handling Buffer Overflow -

    ======================================================================
    Table of Contents

    Affected Software....................................................1
    Severity.............................................................2
    Description of Vulnerability.........................................3
    Solution.............................................................4
    Time Table...........................................................5
    Credits..............................................................6
    References...........................................................7
    About Secunia........................................................8
    Verification.........................................................9

    ======================================================================
    1) Affected Software

    ViRobot Expert 4.0
    ViRobot Advanced Server
    ViRobot Linux Server 2.0
    HAURI LiveCall

    Other versions may also be affected.

    ======================================================================
    2) Severity

    Rating: Highly Critical
    Impact: System access
    Where: Remote

    ======================================================================
    3) Description of Vulnerability

    Secunia Research has discovered a vulnerability in various HAURI
    anti-virus products, which can be exploited by malicious people to
    compromise a vulnerable system.

    The vulnerability is caused due to a boundary error in the ACE
    archive decompression library vrAZace.dll when extracting an archive.
    This can be exploited to cause a stack-based buffer overflow when
    scanning a malicious ACE archive containing a compressed file with
    a filename longer than 272 characters.

    Successful exploitation allows arbitrary code execution, but requires
    that compressed file scanning is enabled.

    The vulnerability is related to:
    http://secunia.com/SA14359

    ======================================================================
    4) Solution

    Apply patches.

    ViRobot Linux Server 2.0:
    http://www.globalhauri.com/html/download/down_unixpatch.html

    ViRobot Expert 4.0 / ViRobot Advanced Server:
    Update to the latest version via online update (vrazmain.dll
    version 5.8.22.137).

    HAURI LiveCall:
    Update to the latest version by visiting the vendor's LiveCall
    website (vrazmain.dll version 5.8.22.137).

    ======================================================================
    5) Time Table

    15/08/2005 - Initial vendor notification.
    17/08/2005 - Vendor released patch for VR Linux Server.
    23/08/2005 - Vendor released patch for VR Expert, VR Advanced Server
                 and LiveCall via online update.
    24/08/2005 - Public disclosure.

    ======================================================================
    6) Credits

    Discovered by Tan Chew Keong, Secunia Research.

    ======================================================================
    7) References

    HAURI:
    http://www.globalhauri.com/html/download/down_unixpatch.html

    ======================================================================
    8) About Secunia

    Secunia collects, validates, assesses, and writes advisories regarding
    all the latest software vulnerabilities disclosed to the public. These
    advisories are gathered in a publicly available database at the
    Secunia website:

    http://secunia.com/

    Secunia offers services to our customers enabling them to receive all
    relevant vulnerability information to their specific system
    configuration.

    Secunia offers a FREE mailing list called Secunia Security Advisories:

    http://secunia.com/secunia_security_advisories/

    ======================================================================
    9) Verification

    Please verify this advisory by visiting the Secunia website:
    http://secunia.com/secunia_research/2005-33/advisory/

    Complete list of vulnerability reports published by Secunia Research:
    http://secunia.com/secunia_research/

    ======================================================================

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Jérôme ATHIAS: "Re: [Full-disclosure] talk.google.com"

    Relevant Pages