Multiple Vendor Anti-Virus Scanner Remote Denial Of Service Vulnerability

Bugtraq ID:	10537
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jun 14 2004 12:00AM
Updated:	Jun 14 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Bipin Gautam <[email protected]>.
Vulnerable:	Symantec Norton AntiVirus Corporate Edition 7.60.build 926 Symantec Norton AntiVirus 2003 Professional Edition Symantec Norton Antivirus 2003 0 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec Norton AntiVirus 2002 Professional Edition Symantec Norton AntiVirus 2002 0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Symantec AntiVirus for Handhelds 3.0 RAV AntiVirus Online Virus Scan Panda Antivirus Platinum 2.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 McAfee VirusScan Enterprise 7.1 McAfee VirusScan 6.0 McAfee UVscan scan for Linux 4.3.20 Frisk Software F-Prot Antivirus for Linux and BSD 4.4.2 Dr.Web Dr.Web Computer Associates InoculateIT 6.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - IBM AIX 4.2.1 - IBM AIX 4.2 - IBM AIX 4.1.5 - IBM AIX 4.1.4 - IBM AIX 4.1.3 - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Redhat Linux 7.1 i386 - Redhat Linux 7.0 i386 - Redhat Linux 6.2 i386 - SCO eDesktop 2.4 - SCO eServer 2.3.1 - SCO eServer 2.3 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.1 x86 - SuSE Linux 7.0 - SuSE Linux 6.4 Computer Associates eTrust Antivirus 6.0 Clam Anti-Virus ClamAV 0.70 AVG AVG Anti-Virus 7.0.251 AVG AVG Anti-Virus 6.0.710
Not Vulnerable:	Computer Associates eTrust Antivirus 7.0 SP2 Computer Associates eTrust Antivirus 7.0

Multiple Vendor Anti-Virus Scanner Remote Denial Of Service Vulnerability

Multiple vendor anti-virus scanning software is reported prone to a remote denial of service vulnerability.

The issue is reported to present itself when certain malicious archives containing large quantities of data are scanned.

In the supplied example approximately 300 Gigabytes of data is archived in many different archive types. This archive may be transmitted to a client or submitted to an online anti-virus scanning service in order to crash the anti-virus software.

Multiple Vendor Anti-Virus Scanner Remote Denial Of Service Vulnerability

There is no exploit required. A proof of concept to exploit this vulnerability is publically available.

Multiple Vendor Anti-Virus Scanner Remote Denial Of Service Vulnerability

Solution:
Computer Associates has reported that this vulnerability affects build 85 of eTrust Antivirus 6.0. eTrust Antivirus 6.0 builds; 96, 101, 102 and the cumulative fix are not reported to be affected. Customers are advised to contact Computer Associates for further information.

Multiple Vendor Anti-Virus Scanner Remote Denial Of Service Vulnerability

References:

• Antivirus/Trojan/Spyware scanners DoS [summary] (Bipin Gautam )