|
Symantec AntiVirus Products RAR Archive Virus Detection Bypass
|
|
Secunia Advisory:
|
SA15153
|
|
|
Release Date:
|
2005-04-28
|
|
Last Update:
|
2005-05-02
|
|
Popularity:
|
14,781 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Security Bypass
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Symantec AntiVirus Scan Engine 4.x
Symantec AntiVirus/Filtering for Domino 3.x
Symantec Mail Security for Exchange 4.x
Symantec Mail Security for SMTP 4.x
Symantec Norton AntiVirus 2005
Symantec Norton Internet Security 2005
Symantec Norton SystemWorks 2005
Symantec Web Security 3.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-1346
|
|
Description:
André Jerleke has reported a vulnerability in various Symantec AntiVirus products, which can be exploited by malware to bypass certain scanning functionality.
The vulnerability is caused due to an error in the Symantec Antivirus component when processing encoded or archived content. This can be exploited to crash the decomposer component when parsing a specially crafted RAR file.
Successful exploitation causes malware inside the RAR file to bypass the scanning functionality.
This vulnerability primarily poses a risk in environments where virus scanning only is performed on gateway systems, as the malware still is detected by the RealTime Virus Scan / Auto-Protect functionality when extracted on systems running Symantec Antivirus.
Certain Windows builds of the following products are affected:
* Symantec Web Security
* Symantec Mail Security for SMTP
* Symantec AntiVirus Scan Engine
* Symantec SAV/Filter for Domino NT
* Symantec Mail Security for Exchange
* Symantec Norton AntiVirus 2005
* Symantec Norton Internet Security 2005
* Symantec Norton System Works 2005
NOTE: See the vendor advisory for a list of affected and fixed versions.
Solution:
Updates are available via LiveUpdate and from the Symantec Support site.
http://www.symantec.com/techsupp/
Provided and/or discovered by:
André Jerleke
Changelog:
2005-05-02: Added CVE reference.
Original Advisory:
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2005.04.27.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
