Kingsoft Internet Security Archive Parsing Denial of Service Vulnerabilities

Bugtraq ID:	37247
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 07 2009 12:00AM
Updated:	Dec 10 2009 10:04PM
Credit:	Francis Provencher
Vulnerable:	Beijing Kingsoft Co.,Ltd Kingsoft Internet Security 9
Not Vulnerable:

Kingsoft Internet Security Archive Parsing Denial of Service Vulnerabilities

Kingsoft Internet Security is prone to multiple denial-of-service vulnerabilities.

Attackers can exploit this issue to cause the application to crash, denying service to legitimate users. This may help attackers launch further attacks while the security application isn't running.

Kingsoft Internet Security 9 is vulnerable; other versions may also be affected.

Kingsoft Internet Security Archive Parsing Denial of Service Vulnerabilities

Example archives are available from the following locations:

http://www.exploit-db.com/sploits/PRL_CPU_Hang.arj
http://www.exploit-db.com/sploits/PRL_Crash.cab

Note that Symantec has not verified or tested these files.

Kingsoft Internet Security Archive Parsing Denial of Service Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Kingsoft Internet Security Archive Parsing Denial of Service Vulnerabilities

References:

• Kingsoft Internet Security (Kingsoft Research Corporation)