Kaspersky Products URI Parsing Denial of Service Vulnerability

Bugtraq ID:	36084
Class:	Unknown
CVE:	CVE-2009-2966
Remote:	Yes
Local:	No
Published:	Aug 19 2009 12:00AM
Updated:	Apr 13 2015 09:08PM
Credit:	Maksymilian Arciemowicz
Vulnerable:	Kaspersky Internet Security 2010 9.0.0.459 Kaspersky Anti-Virus 2010 9.0.0.463
Not Vulnerable:

Kaspersky Products URI Parsing Denial of Service Vulnerability

Kaspersky products are prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause denial-of-service conditions in an affected application.

This issue affects the following:

Kaspersky Internet Security 2010 9.0.0.459 (a) EN
Kaspersky Anti-Virus 2010 9.0.0.463 DE

Kaspersky Products URI Parsing Denial of Service Vulnerability

The following example URI is available:

http://www.example.com/.................[ .xY where 1024<Y]

The following exploit is available:

• /data/vulnerabilities/exploits/36084.html

Kaspersky Products URI Parsing Denial of Service Vulnerability

Solution:
Reports indicate that the vendor has fixed the affected signature in a database update. Users should be able to obtain the update automatically through the application's update mechanism. Please see the references for more information.

Kaspersky Products URI Parsing Denial of Service Vulnerability

References:

• Kaspersky confirm and close DoS vulnerability (Heise Media)
  
• Kaspersky Homepage (Kaspersky)
  
• Kaspersky AV/IS 2010 (avp.exe) Denial-of-Service (SecurityReason)