McAfee VirusScan On-Access Scanner File Name Buffer Overflow Vulnerability

Bugtraq ID:	23543
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 17 2007 12:00AM
Updated:	Apr 23 2007 10:20PM
Credit:	iDefense Labs disclosed this vulnerability.
Vulnerable:	McAfee VirusScan Enterprise 8.0 i patch 11 McAfee VirusScan Enterprise 8.0 i
Not Vulnerable:	McAfee VirusScan Enterprise 8.0 i patch 15 McAfee VirusScan Enterprise 8.0 i patch 12

McAfee VirusScan On-Access Scanner File Name Buffer Overflow Vulnerability

McAfee VirusScan On-Access Scanner is prone to a filename-buffer-overflow vulnerability. The application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

A remote attacker may exploit this issue to execute arbitrary code on a vulnerable computer with SYSTEM privileges. Failed exploit attempts may disable the On-Access Scanner component of McAfee VirusScan.

McAfee VirusScan On-Access Scanner 8.0i Enterprise Patch 11 and earlier versions are vulnerable to this issue.

McAfee VirusScan On-Access Scanner File Name Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

McAfee VirusScan On-Access Scanner File Name Buffer Overflow Vulnerability

Solution:
Please see the referenced vendor advisories for details on obtaining and applying fixes.

McAfee VirusScan On-Access Scanner File Name Buffer Overflow Vulnerability

References:

• 612750 - McAfee Security Bulletin - VirusScan Enterprise 8.0i Patch 12 or later (McAfee)
  
• McAfee VirusScan Enterprise (McAfee)
  
• McAfee VirusScan On-Access Scanner Long Unicode File Name Buffer Overflow (iDEFENSE)
  
• iDefense Security Advisory 04.17.07: McAfee VirusScan On-Access Scanner Long Un (iDefense Labs)
  
• Vulnerability Note VU#324929 McAfee VirusScan Enterprise heap buffer overflow vu (CERT)