what you don't know can hurt you

iDEFENSE Security Advisory 2007-07-24.1

iDEFENSE Security Advisory 2007-07-24.1
Posted Jul 25, 2007
Authored by iDefense Labs | Site idefense.com

iDefense Security Advisory 07.24.07 - Remote exploitation of a denial of Service (DoS) vulnerability in Computer Associates Inc.'s eTrust Antivirus products could allow attackers to create a DoS condition on the affected computer. When eTrust Antivirus engine scans a malformed CHM file that has an invalid 'previous listing chunk number' field, the scanner will enter an infinite loop and be unable to process any other files. iDefense has confirmed this vulnerability in eTrust AntiVirus version r8. Previous versions of eTrust Antivirus are suspected vulnerable. Other Computer Associates products, as well as derived products, may also be vulnerable.

tags | advisory, remote, denial of service
advisories | CVE-2007-3875
MD5 | c9e430e97c86ccb8e479f4edf4a11819

iDEFENSE Security Advisory 2007-07-24.1

Change Mirror Download
Computer Associates AntiVirus CHM File Handling DoS Vulnerability

iDefense Security Advisory 07.24.07
http://labs.idefense.com/intelligence/vulnerabilities/
Jul 24, 2007

I. BACKGROUND

eTrust is an antivirus application developed by Computer Associates.
More information can be found on the vendor's website at the following
URL.

http://www3.ca.com/solutions/product.aspx?ID=156

II. DESCRIPTION

Remote exploitation of a denial of Service (DoS) vulnerability in
Computer Associates Inc.'s eTrust Antivirus products could allow
attackers to create a DoS condition on the affected computer.

When eTrust Antivirus engine scans a malformed CHM file that has an
invalid 'previous listing chunk number' field, the scanner will enter
an infinite loop and be unable to process any other files.

III. ANALYSIS

This denial of service attack will prevent the scanner from scanning
other files on disk while it is stuck on the exploit file. The hung
process can be quit by the user and does not consume all system
resources.

IV. DETECTION

iDefense has confirmed this vulnerability in eTrust AntiVirus version
r8. Previous versions of eTrust Antivirus are suspected vulnerable.
Other Computer Associates products, as well as derived products, may
also be vulnerable.

V. WORKAROUND

iDefense is not aware of any workarounds for this issue.

VI. VENDOR RESPONSE

Computer Associates has addressed this vulnerability by releasing
updates. These updates are available via the products' automatic update
features. More information is available within Computer Associates
advisory at the following URL.

http://supportconnectw.ca.com/public/antivirus/infodocs/caprodarclib-secnot.asp

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2007-3875 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

01/16/2007 Initial vendor notification
01/17/2007 Initial vendor response
07/24/2007 Coordinated public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright © 2007 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    24 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    7 Files
  • 4
    Oct 4th
    4 Files
  • 5
    Oct 5th
    10 Files
  • 6
    Oct 6th
    1 Files
  • 7
    Oct 7th
    21 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    5 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    17 Files
  • 12
    Oct 12th
    4 Files
  • 13
    Oct 13th
    4 Files
  • 14
    Oct 14th
    15 Files
  • 15
    Oct 15th
    19 Files
  • 16
    Oct 16th
    25 Files
  • 17
    Oct 17th
    17 Files
  • 18
    Oct 18th
    7 Files
  • 19
    Oct 19th
    1 Files
  • 20
    Oct 20th
    4 Files
  • 21
    Oct 21st
    2 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close