Symantec Decomposer RAR File Remote Buffer Overflow Vulnerability

Bugtraq ID:	27913
Class:	Boundary Condition Error
CVE:	CVE-2008-0309
Remote:	Yes
Local:	No
Published:	Feb 26 2008 12:00AM
Updated:	Feb 27 2008 04:42PM
Credit:	iDefense is credited with discovering this issue.
Vulnerable:	Symantec Scan Engine 5.1.4.24 Symantec Mail Security for Microsoft Exchange 5.0 Symantec Mail Security for Microsoft Exchange 4.6.3 Symantec Mail Security for Microsoft Exchange 4.6.3 Symantec Mail Security for Microsoft Exchange 4.6 build 97 Symantec Mail Security for Microsoft Exchange 4.6 build 97 Symantec Mail Security for Microsoft Exchange 4.6 build 4.6.1.107 Symantec Mail Security for Microsoft Exchange 4.5 build 719 Symantec Mail Security for Microsoft Exchange 4.5 build 4.5.4.743 Symantec Mail Security for Microsoft Exchange 4.5 build 743 Symantec Mail Security for Microsoft Exchange 4.5 build 741 Symantec Mail Security for Microsoft Exchange 4.5 build 736 Symantec Mail Security for Microsoft Exchange 4.5 Symantec Mail Security for Microsoft Exchange 4.1 build 459 Symantec Mail Security for Microsoft Exchange 4.1 build 458 Symantec Mail Security for Microsoft Exchange 4.1 461 Symantec Mail Security for Microsoft Exchange 4.0 build 743 Symantec Mail Security for Microsoft Exchange 4.0 build 741 Symantec Mail Security for Microsoft Exchange 4.0 build 736 Symantec Mail Security for Microsoft Exchange 4.0 build 465 Symantec Mail Security for Microsoft Exchange 4.0 build 463 Symantec Mail Security for Microsoft Exchange 4.0 build 456 Symantec Mail Security for Microsoft Exchange 4.0 build 465 Symantec Mail Security for Microsoft Exchange 4.0 build 463 Symantec Mail Security for Microsoft Exchange 4.0 build 456 Symantec Mail Security for Microsoft Exchange 4.0 Symantec Mail Security for Microsoft Exchange 5.0.7.373 Symantec Mail Security for Microsoft Exchange 5.0.4.363 Symantec Mail Security for Microsoft Exchange 5.0.0.024 Symantec AntiVirus/Filtering for Domino MPE 0 Symantec AntiVirus Scan Engine for Network Attached Storage 4.3.16.39 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3.17 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3.12 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3.16.39 Symantec AntiVirus Scan Engine for Messaging 4.3.12 Symantec AntiVirus Scan Engine for Messaging 4.3 Symantec AntiVirus Scan Engine for Messaging 4.3.16.39 Symantec AntiVirus Scan Engine for ISA 4.3.12 Symantec AntiVirus Scan Engine for ISA 4.3 build 4.3.3 Symantec AntiVirus Scan Engine for ISA 4.3 Symantec AntiVirus Scan Engine for ISA 4.0 Symantec AntiVirus Scan Engine for ISA 4.3.16.39 Symantec AntiVirus Scan Engine for Clearswift 4.3.12 Symantec AntiVirus Scan Engine for Clearswift 4.3 Symantec AntiVirus Scan Engine for Clearswift 4.0 Symantec AntiVirus Scan Engine for Clearswift 4.3.16.39 Symantec AntiVirus Scan Engine for Caching 4.3.12 Symantec AntiVirus Scan Engine for Caching 4.3 Symantec AntiVirus Scan Engine for Caching 4.3.16.39 Symantec AntiVirus Scan Engine 4.3.12 Symantec AntiVirus Scan Engine 4.3 build 4.3.8.29 Symantec AntiVirus Scan Engine 4.3 build 4.3.7.27 Symantec AntiVirus Scan Engine 4.3 build 4.3.3 Symantec AntiVirus Scan Engine 4.3 Symantec AntiVirus Scan Engine 4.1.8 Symantec AntiVirus Scan Engine 4.1 Symantec AntiVirus Scan Engine 4.0 Symantec AntiVirus for Network Attached Storage
Not Vulnerable:	Symantec Scan Engine 5.1.6.31 Symantec Mail Security for Microsoft Exchange 5.0.6.368 Symantec Mail Security for Microsoft Exchange 4.6.8.120 Symantec AntiVirus/Filtering for Domino MPE 3.2.2 Symantec AntiVirus Scan Engine for Network Attached Storage 4.3.18.43 Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3.18.43 Symantec AntiVirus Scan Engine for Messaging 4.3.18.43 Symantec AntiVirus Scan Engine for ISA 4.3.18.43 Symantec AntiVirus Scan Engine for Clearswift 4.3.18.43 Symantec AntiVirus Scan Engine for Caching 4.3.18.43 Symantec AntiVirus Scan Engine 4.3.18.43

Symantec Decomposer RAR File Remote Buffer Overflow Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symantec Decomposer RAR File Remote Buffer Overflow Vulnerability

Solution:
Symantec released fixes to address this issue. Please see the references for more information.

Symantec Decomposer RAR File Remote Buffer Overflow Vulnerability

References:

• Symantec Homepage (Symantec)
  
• iDefense Security Advisory 02.26.08: Symantec Scan Engine 5.1.2 RAR File Buffer (iDefense Labs )
  
• iDefense Security Advisory 02.26.08: Symantec Scan Engine 5.1.2 RAR File Buffer (iDefense Labs)
  
• SYM08-006 Symantec Decomposer: Multiple Denial of Service Vulnerabilities (Symantec)