[UNIX] Sophos Anti-Virus Zip DoS Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 07/20/05

  • Next message: SecuriTeam: "[EXPL] OpenBB CID SQL Injection (Exploit)" 
    To: list@securiteam.com
Date: 20 Jul 2005 12:43:02 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Sophos Anti-Virus Zip DoS Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.sophos.com> Sophos Small Business Suite is the best possible
    defence against viruses, spam and malicious spyware."

    Remote exploitation of a denial of service vulnerability in Sophos Plc.'s
    Sophos Anti-Virus engine allows attackers to exhaust CPU resources on the
    target system and prevent further scans.

    DETAILS

    Vulnerable Systems:
     * Sophos Anti-Virus version 5.0.1
     * Sophos Anti-Virus version 3.91
     * Sophos Anti-Virus version 3.90

    The problem specifically exists in the handling of Zip files compressed
    using the BZIP2 algorithm. When scanning within a BZIP2 archive the Sophos
    engine will not perform any sanity checks on the 'Extra field length'
    value. By specifying an abnormally large value for this field the analysis
    routine is forced into an infinite loop leading to CPU exhaustion. The
    following is a hex dump of an example file that will trigger the issue:

    00 50 4b 03 04 0a 00 00 00 0c 00 5c 84 67 32 5b 26 |PK........\.g2[&|
    10 b9 09 01 00 00 00 01 00 00 00 03 00 ff ff 66 6f |..............fo|
    20 6f 55 54 09 00 03 a0 74 2c 42 a1 74 2c 42 55 78 |oUT....t,B.t,BUx|
    30 04 00 e8 03 e8 03 2a 50 4b 01 02 17 03 0a 00 00 |......*PK.......|
    40 00 00 00 5c 84 67 32 5b 26 b9 09 01 00 00 00 01 |...\.g2[&.......|
    50 00 00 00 03 00 0d 00 00 00 00 00 01 00 00 00 a4 |................|
    60 81 00 00 00 00 66 6f 6f 55 54 05 00 03 a0 74 2c |.....fooUT....t,|
    70 42 55 78 00 00 50 4b 05 06 00 00 00 00 01 00 01 |BUx..PK.........|
    80 00 3e 00 00 00 37 00 00 00 00 00 |.>...7.....|

    Bytes 08-09: Compression method - 0x000c == BZIP2 algorithm Bytes 28-29:
    Extra field length - 0xffff . The function BZ2_decompress(), among others,
    is called within the infinite loop.

    Successful exploitation allows remote attackers to trigger a denial of
    service condition on the target system. Remote exploitation can be
    achieved by sending a malicious file in an e-mail message or during an
    HTTP session. Exploitation is only possible if the 'Scan inside archive
    files' option is enabled. This is not a default option but is a common
    setting. Both Unix and Windows systems running a vulnerable version of
    Sophos Anti-Virus are affected.

    Workaround:
    Disable the "Scan inside archive files" option.

    Vendor Response:
    "We have now included protection against this vulnerability into the
    latest versions of Sophos Anti-Virus on Windows, UNIX, Linux, Netware,
    OpenVMS and Mac OSX (version 3.95.0 on all those platforms as well as
    version 5.0.4 on Windows 2000/XP/2003 and versions 4.5.3 on Windows NT and
    Windows 95/98/Me) as well as into the latest updated versions of
    PureMessage for UNIX, PureMessage for Windows/Exchange and MailMonitor
    (any version running anti-virus engine 2.30.4 or above).

    All of these versions would be updated automatically to customers using
    our automatic updating through EM Library or direct from Sophos.
    They are also available to customers to download at
    <http://www.sophos.com/support/updates>
    http://www.sophos.com/support/updates".

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1530>
    CAN-2005-1530

    Disclosure Timeline:
    05/12/2005 - Initial vendor notification
    05/16/2005 - Initial vendor response
    07/14/2005 - Public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by iDEFENSE Labs.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=283&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=283&type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] OpenBB CID SQL Injection (Exploit)"

    Relevant Pages

    • [NEWS] Sophos Anti-Virus Petite File DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sophos Anti-Virus is comprehensive scanning solution ... Vulnerable Systems: ... Successful exploitation would result in the scanning engine attempting to ...
      (Securiteam)
    • [NT] Sophos Anti-Virus XSS Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sophos Anti-Virus XSS Vulnerability ... 21 August 2007 - Second Vendor Response ...
      (Securiteam)
    • [NT] Windows Embedded Open Type (EOT) Font Heap Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability in the way that Windows uncompresses Embedded Open Type ... fonts allow the author of a malicious web page to execute arbitrary code ... A heap overflow vulnerability exists in T2EMBED.DLL, ...
      (Securiteam)
    • [NT] Windows VDM #UD Local Privilege Escalation
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... vulnerability to fully compromise a Windows NT 4.0, Windows 2000, Windows ... 32-bit VDM "host" code, and the invalid opcode fault handler within the ... process).The kernel does not validate the address to which execution is ...
      (Securiteam)
    • [NT] Microsoft Windows Color Management Module Heap Buffer Overflow Vulnerability (MS08-046)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Windows Color Management Module Heap Buffer Overflow ... vulnerability in multiple versions of Microsoft Corp.'s Windows operating ... Keep in mind that this only blocks the attack vector through Windows ...
      (Securiteam)