[security-alerts] FW: [SA16851] AhnLab V3 Antivirus ALZ/UUE/XXE Archive Handling Buffer Overflow

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> 
> TITLE:
> AhnLab V3 Antivirus ALZ/UUE/XXE Archive Handling Buffer Overflow
> 
> SECUNIA ADVISORY ID:
> SA16851
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/16851/
> 
> CRITICAL:
> Highly critical
> 
> IMPACT:
> System access
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> AhnLab V3Net for Windows Server 6.x
> http://secunia.com/product/5700/
> AhnLab MyV3
> http://secunia.com/product/5854/
> AhnLab V3Pro 2004 (AhnLab V3 VirusBlock 2005)
> http://secunia.com/product/5699/
> 
> DESCRIPTION:
> Secunia Research has discovered a vulnerability in AhnLab V3
> Antivirus, which can be exploited by malicious people to compromise a
> vulnerable system.
> 
> The vulnerability is caused due to a boundary error in the archive
> decompression library when reading the filename of a compressed file
> from an ALZ, UUE or XXE archive. This can be exploited to cause a
> stack-based buffer overflow (ALZ), or a heap-based buffer overflow
> (UUE/XXE), when a malicious ALZ/UUE/XXE archive is scanned.
> 
> Successful exploitation allows arbitrary code execution, but requires
> that compressed file scanning is enabled.
> 
> The vulnerability has been confirmed in the following products:
> * AhnLab V3Pro 2004 (AhnLab V3 VirusBlock 2005 international) (Build
> 6.0.0.457)
> * AhnLab V3Net for Windows Server 6.0 (Build 6.0.0.457)
> * AhnLab MyV3 with AzMain.dll 1.3.11.15
> 
> Prior versions may also be affected.
> 
> SOLUTION:
> AhnLab V3Pro 2004 (V3 VirusBlock 2005 international):
> Update to version 6.0.0.488 via Smart Update.
> 
> AhnLab V3Net for Windows Server 6.0:
> Update to version 6.0.0.488 via Smart Update.
> 
> AhnLab MyV3:
> The vulnerability has reportedly been fixed in the vendor's Korean
> MyV3 website.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Tan Chew Keong, Secunia Research
> 
> ORIGINAL ADVISORY:
> AhnLab:
> http://global.ahnlab.com/security/security_advisory002.html
> 
> Secunia Research:
> http://secunia.com/secunia_research/2005-48/advisory/
> 
>