Symantec Brightmail AntiSpam Deeply Nested Zip File Denial Of Service Vulnerability

Bugtraq ID:	14757
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Sep 07 2005 12:00AM
Updated:	Sep 07 2005 12:00AM
Credit:	This issue was announced by the vendor.
Vulnerable:	Symantec Mail Security 8200 Series Appliance Symantec Brightmail Anti-Spam 6.0.2 Symantec Brightmail Anti-Spam 6.0.1
Not Vulnerable:

Symantec Brightmail AntiSpam Deeply Nested Zip File Denial Of Service Vulnerability

Symantec Brightmail AntiSpam is prone to a denial of service vulnerability. This issue occurs when the application antivirus scanner/cleaner processes deeply nested zip files.

Symantec Brightmail AntiSpam Deeply Nested Zip File Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Symantec Brightmail AntiSpam Deeply Nested Zip File Denial Of Service Vulnerability

Solution:
Symantec has released a patch to address the issue.

Symantec has released Advisory SYM05-016 regarding this issue; please see the referenced advisory for further details.


Symantec Brightmail Anti-Spam 6.0.2

• Symantec patch157.zip
  ftp://ftp.symantec.com/public/english_us_canada/products/sba/sba_60x/u pdates/patch157.zip

Symantec Brightmail AntiSpam Deeply Nested Zip File Denial Of Service Vulnerability

References:

• Brightmail Homepage (Symantec)
  
• Patch 157 resolves issues with antivirus scanning (Symantec)
  
• Symantec Brightmail AntiSpam: Nested Zip File, Denial of Service (Symantec)