Sophos Anti-Virus Scanning Engine Veex.DLL Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	21563
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 12 2006 12:00AM
Updated:	Jul 06 2016 01:33PM
Credit:	An anonymous researcher has been credited with the discovery of this vulnerability.
Vulnerable:	Sophos Anti-Virus 5.2.1 Sophos Anti-Virus 5.2 Sophos Anti-Virus 5.0.4 Sophos Anti-Virus 5.0.2 Sophos Anti-Virus 5.0.1 Sophos Anti-Virus 4.7.2 Sophos Anti-Virus 4.7.1 Sophos Anti-Virus 4.5.12 Sophos Anti-Virus 4.5.11 Sophos Anti-Virus 4.5.4 Sophos Anti-Virus 4.5.3 Sophos Anti-Virus 3.96 .0 Sophos Anti-Virus 3.95 Sophos Anti-Virus 3.91 Sophos Anti-Virus 3.90 Sophos Anti-Virus 3.86 Sophos Anti-Virus 3.85 Sophos Anti-Virus 3.84 Sophos Anti-Virus 3.83 Sophos Anti-Virus 3.82 Sophos Anti-Virus 3.81 Sophos Anti-Virus 3.80 Sophos Anti-Virus 3.79 Sophos Anti-Virus 3.78 d Sophos Anti-Virus 3.78 Sophos Anti-Virus 3.4.6 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Sophos Anti-Virus 6.0 Sophos Anti-Virus 5.1 Sophos Anti-Virus 4.05 Sophos Anti-Virus 4.04
Not Vulnerable:	Sophos Anti-virus Scanning Engine 2.40.2 Sophos Anti-Virus 6.5

Sophos Anti-Virus Scanning Engine Veex.DLL Multiple Buffer Overflow Vulnerabilities

Sophos antivirus scanning engine is prone to multiple remote stack-based buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit these issues to execute arbitrary code with SYSTEM-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts will cause denial-of-service conditions.

Versions prior to 2.4.0 are vulnerable to this issue.

Sophos Anti-Virus Scanning Engine Veex.DLL Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sophos Anti-Virus Scanning Engine Veex.DLL Multiple Buffer Overflow Vulnerabilities

References:

• Sophos Anti-Virus: scanning vulnerability identified (Sophos)
  
• Vendor Home Page (Sophos )
  
• ZDI-06-045: Sophos Anti-Virus CPIO Archive Parsing Buffer Overflow Vulnerability ([email protected])
  
• ZDI-06-046: Sophos Anti-Virus SIT Archive Parsing Buffer Overflow Vulnerability ([email protected])