Ahnlab V3 Antivirus Multiple Archive Format Handling Remote Buffer Overflow Vulnerability

Bugtraq ID:	15091
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 13 2005 12:00AM
Updated:	Oct 13 2005 12:00AM
Credit:	Discovery is credited to Tan Chew Keong, Secunia Research.
Vulnerable:	Ahnlab V3Pro 2004 6.0 .0.457 Ahnlab V3Net for Windows Server 6.0 6.0 .0.457 Ahnlab MyV3 1.3.11 .15
Not Vulnerable:	Ahnlab V3Pro 2004 6.0 .0.488 Ahnlab V3Net for Windows Server 6.0 6.0 .0.488

Ahnlab V3 Antivirus Multiple Archive Format Handling Remote Buffer Overflow Vulnerability

Ahnlab V3 Antivirus is affected by a remote buffer overflow vulnerability when handling various archive formats.

An attacker can exploit this issue by crafting a malicious archive and sending the archive to a computer to be scanned by the affected application.

An attacker may exploit this vulnerability to gain unauthorized remote access with SYSTEM privileges.

Ahnlab V3 Antivirus Multiple Archive Format Handling Remote Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Ahnlab V3 Antivirus Multiple Archive Format Handling Remote Buffer Overflow Vulnerability

Solution:
The vendor has released upgrades for Ahnlab V3Net for Windows Server 6.0 and Ahnlab V3Pro 2004. Users are advised to upgrade through the online update functionality of the application.

Reports indicate that a fix for AhnLab MyV3 is available from the vendor's Korean Web site.

Ahnlab V3 Antivirus Multiple Archive Format Handling Remote Buffer Overflow Vulnerability

References:

• Ahnlab Home Page (Ahnlab)
  
• Secunia Research: AhnLab V3 Antivirus ALZ/UUE/XXE Archive Handling Buffer Overfl (Secunia Research )