----------------------------------------------------------------------

BETA test the new Secunia Personal Software Inspector!

The Secunia PSI detects installed software on your computer and
categorises it as either Insecure, End-of-Life, or Up-To-Date.
Effectively enabling you to focus your attention on software
installations where more secure versions are available from the
vendors.

Download the free PSI BETA from the Secunia website:
https://psi.secunia.com/

----------------------------------------------------------------------

TITLE:
Sophos Anti-Virus Multiple Archive Detection Bypass

SECUNIA ADVISORY ID:
SA26726

VERIFY ADVISORY:
http://secunia.com/advisories/26726/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
>From remote

SOFTWARE:
Sophos PureMessage Small Business Edition 2.x
http://secunia.com/product/9823/
Sophos PureMessage for Windows/Exchange 2.x
http://secunia.com/product/5623/
Sophos PureMessage for UNIX 5.x
http://secunia.com/product/5622/
Sophos PureMessage for UNIX 4.x
http://secunia.com/product/3876/
Sophos MailMonitor for SMTP
http://secunia.com/product/165/
Sophos MailMonitor for Notes/Domino
http://secunia.com/product/5624/
Sophos Enterprise Manager (EM Library) 1.x
http://secunia.com/product/166/
Sophos Endpoint Security and Control 7
http://secunia.com/product/14828/
Sophos Anti-Virus Small Business Edition 2.x
http://secunia.com/product/14829/
Sophos Anti-Virus Small Business Edition
http://secunia.com/product/9822/
Sophos Anti-Virus for Windows 6.x
http://secunia.com/product/12449/
Sophos Anti-Virus 7.x
http://secunia.com/product/15621/
Sophos Anti-Virus 5.x
http://secunia.com/product/5390/
Sophos Anti-Virus 4.x
http://secunia.com/product/5391/
Sophos Anti-Virus 3.x
http://secunia.com/product/164/

DESCRIPTION:
Some vulnerabilities have been reported in Sophos Anti-Virus, which
can be exploited by malware to bypass the scanning functionality.

The vulnerabilities are caused due to errors in the handling of CAB,
LZH and RAR archives with malformed file headers. These can be
exploited to bypass the anti-virus scanning functionality via a
specially crafted CAB, LZH, or RAR file.

The vulnerabilities are reported in all versions of Sophos Anti-Virus
with engine versions prior to 2.49.0.

SOLUTION:
Update to engine version 2.49.0.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Thierry Zoller, n.runs AG.

ORIGINAL ADVISORY:
http://www.sophos.com/support/knowledgebase/article/29146.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------