Multiple Vendor File Scanner Malicious Archive DoS Vulnerability

Bugtraq ID:	3027
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jul 12 2001 12:00AM
Updated:	Jul 12 2001 12:00AM
Credit:	First discussed in vuln-dev mailing list in a thread started by Michel Arboi < [email protected] > on June 18, 2001.
Vulnerable:	F-Secure Anti-Virus 5.2.1 F-Secure Anti-Virus 5.0.2 Baltimore Technologies MAILsweeper for SMTP 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT Workstation 4.0
Not Vulnerable:	Sophos Anti-Virus 3.4.6 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 McAfee WebShield SMTP 4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 McAfee VirusScan 4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 McAfee VirusScan 4.0.3 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 McAfee Agent ASaP VirusScan 1.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0

Multiple Vendor File Scanner Malicious Archive DoS Vulnerability

Solution:
Baltimore Technologies has acknowledged this issue, and has reported that MAILsweeper installed on a machine with a single partition is subject to this issue. MAILsweeper configured to use multiple partitions moves the message to a quarantine area once the free space is exhausted. During this process messages will continue to be received and delivered. Baltimore Technologies has released a document (Potential Threat from the â??Zip of Deathâ?) demonstrating the required steps to take in order to mitigate this issue. Please see the reference section to obtain the document

Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Multiple Vendor File Scanner Malicious Archive DoS Vulnerability

References:

• John Leyden: DoS risk from Zip of death attacks on AV software? (The Register)
  
• Potential Threat from the �??Zip of Death�?� (Baltimore Technologies)