Multiple Sophos Products CAB File Scan Evasion Vulnerability

Bugtraq ID:	35402
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 16 2009 12:00AM
Updated:	Jun 22 2009 04:59PM
Credit:	Thierry Zoller
Vulnerable:	Sophos Web Appliance 2.1.18 Sophos PureMessage for UNIX 5.5.4 Sophos PureMessage for UNIX 4.05 Sophos PureMessage for UNIX 4.04 Sophos Email Appliance 3.1.3 .1 Sophos Email Appliance 2.1.1 .0 Sophos Email Appliance 2.1 0 Sophos Email Appliance 0 Sophos Anti-Virus for Windows 7.6.7 Sophos Anti-Virus for Windows 7.6.3 Sophos Anti-Virus for Windows 4.7.22 Sophos Anti-Virus for Windows 0 Sophos Anti-Virus for Unix and Netware 7.0.5 Sophos Anti-Virus for Unix and Netware 0 Sophos Anti-Virus for UNIX 7.0.9 Sophos Anti-Virus for UNIX 7.0.5 Sophos Anti-Virus for UNIX 4.41.9 Sophos Anti-Virus for UNIX 0 Sophos Anti-Virus for OS X 4.9.22 Sophos Anti-Virus for OS X 4.9.16 Sophos Anti-Virus for OS X 7.01 Sophos Anti-Virus for OS X 0 Sophos Anti-Virus for Netware 4.41.9 Sophos Anti-Virus for Linux (on-access) 5.0.9 Sophos Anti-Virus for Linux 6.6.2 Sophos Anti-Virus for Linux 6.4.5 Sophos Anti-Virus for Linux 0 Sophos Anti-Virus for Linux 0 Sophos Anti-Virus Engine 2.49 Sophos Anti-Virus Engine 2.30.4 Sophos Anti-Virus 6.5.8 Sophos Anti-Virus 6.5.4 R2 Sophos Anti-Virus 6.5 Sophos Anti-Virus 5.2.1 Sophos Anti-Virus 5.2 Sophos Anti-Virus 5.0.4 Sophos Anti-Virus 5.0.2 Sophos Anti-Virus 5.0.1 Sophos Anti-Virus 4.7.2 Sophos Anti-Virus 4.7.1 Sophos Anti-Virus 4.5.12 Sophos Anti-Virus 4.5.11 Sophos Anti-Virus 4.5.4 Sophos Anti-Virus 4.5.3 Sophos Anti-Virus 3.96 .0 Sophos Anti-Virus 3.95 Sophos Anti-Virus 3.91 Sophos Anti-Virus 3.90 Sophos Anti-Virus 3.86 Sophos Anti-Virus 3.85 Sophos Anti-Virus 3.84 Sophos Anti-Virus 3.83 Sophos Anti-Virus 3.82 Sophos Anti-Virus 3.81 Sophos Anti-Virus 3.80 Sophos Anti-Virus 3.79 Sophos Anti-Virus 3.78 d Sophos Anti-Virus 3.78 Sophos Anti-Virus 3.4.6 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Sophos Anti-Virus 7.05 Sophos Anti-Virus 7.01 Sophos Anti-Virus 7.0 Sophos Anti-Virus 6.0 Sophos Anti-Virus 5.1 Sophos Anti-Virus 4.05 Sophos Anti-Virus 4.04
Not Vulnerable:	Sophos Web Appliance 3.0 Sophos PureMessage for UNIX 5.5.5 Sophos Email Appliance 3.1.4 .1 Sophos Anti-Virus for Windows 7.6.8 Sophos Anti-Virus for Windows 4.7.23 Sophos Anti-Virus for UNIX 7.0.10 Sophos Anti-Virus for UNIX 4.42 Sophos Anti-Virus for OS X 4.9.23 Sophos Anti-Virus for OS X 7.02 Sophos Anti-Virus for Netware 4.42 Sophos Anti-Virus for Linux 6.6.3

Multiple Sophos Products CAB File Scan Evasion Vulnerability

Multiple Sophos products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.

Versions prior to the following are vulnerable:

Sophos Anti-Virus for Windows 7.6.8
Sophos Anti-Virus for Windows 4.7.23
Sophos Anti-Virus for OS X 4.9.23/7.02
Sophos Anti-Virus for Linux 6.6.3
Sophos Anti-Virus for UNIX 7.0.10
Sophos Anti-Virus for Unix 4.42.0
Sophos Anti-Virus for Netware 4.42.0
Sophos Email Appliance 3.1.4.1
Sophos Web Appliance 3.0.0
Pure Message for Unix 5.5.5

Multiple Sophos Products CAB File Scan Evasion Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Sophos Products CAB File Scan Evasion Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Multiple Sophos Products CAB File Scan Evasion Vulnerability

References:

• Advisory: Malformed CAB archive vulnerability reported in Sophos products that u (Sophos)
  
• Sophos Homepage (Sophos)