Multiple ESET Products CAB File Scan Evasion Vulnerability

Bugtraq ID:	34764
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 29 2009 12:00AM
Updated:	Apr 29 2009 10:06PM
Credit:	Thierry Zoller
Vulnerable:	Eset Smart Security 4 Business Edition 0 Eset Smart Security 4 0 Eset Novell Netware 0 Eset NOD32 Antivirus for Lotus Domino Server 0 Eset NOD32 Antivirus for Linux Gateway Devices 0 Eset NOD32 Antivirus for Exchange Server 0 Eset NOD32 Antivirus 4 Business Edition 0 Eset NOD32 Antivirus 4 0 Eset Mail Security 0 Eset File Security 0 Eset DELL STORAGE SERVERS 0
Not Vulnerable:

Multiple ESET Products CAB File Scan Evasion Vulnerability

Multiple ESET products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.

ESET products prior to Update 4036 are vulnerable.

Multiple ESET Products CAB File Scan Evasion Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple ESET Products CAB File Scan Evasion Vulnerability

Solution:
Updates are reportedly available. Please see the references for more information.

Multiple ESET Products CAB File Scan Evasion Vulnerability

References:

• Nod32 (Eset) - CAB Generic Evasion (Limited details) (Thierry Zoller)
  
• Vendor Homepage (ESET)
  
• [TZO-16-2009] Nod32 CAB bypass/evasion (Thierry Zoller )