Avira Antivir Antivirus Multiple Remote Vulnerabilities

Bugtraq ID:	24187
Class:	Unknown
CVE:	CVE-2007-2974 CVE-2007-2972
Remote:	Yes
Local:	No
Published:	May 28 2007 12:00AM
Updated:	Jul 05 2016 09:38PM
Credit:	Sergio 'shadown' Alvarez of n.runs discovered these issues.
Vulnerable:	AVIRA AntiVir Workstation Professional Build 367 AVIRA AntiVir PersonalEdition Premium Build 228 AVIRA AntiVir PersonalEdition Classic Build 180 AVIRA AntiVir Engine 0 AVIRA AntiVir AVPack 0 AVIRA Antivir 6.35.00.00
Not Vulnerable:	AVIRA AntiVir Engine 7.4 .24 AVIRA AntiVir AVPack 7.3 .09

Avira Antivir Antivirus Multiple Remote Vulnerabilities

Avira Antivir Antivirus is prone to multiple remote vulnerabilities.

Successfully exploiting these issues allows remote attackers to execute arbitrary machine code with elevated privileges, facilitating the complete compromise of affected computers. Attackers may also trigger denial-of-service conditions by crashing the application or causing infinite loops.

These issues affect:

Avira Antivir AVPack versions prior to 7.03.00.09
Engine versions prior to 7.04.00.24

Avira Antivir Antivirus Multiple Remote Vulnerabilities

Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Avira Antivir Antivirus Multiple Remote Vulnerabilities

Solution:
The vendor has released fixed versions of the affected software. The vendor states that the fixes will be updated via the software's self-updating feature as of 2007-05-23. Please see the references for more information.

Avira Antivir Antivirus Multiple Remote Vulnerabilities

References:

• Avira AntiVir Vulnerabilities (Avira)
  
• Avira Homepage (Avira)
  
• n.runs-SA-2007.010 - Avira Antivir Antivirus LZH parsing Arbitrary Code Executio ([email protected])
  
• n.runs-SA-2007.011 - Avira Antivir Antivirus UPX parsing Divide by Zero Advisory ([email protected])