Computer Associates AntiVirus CHM File Handling DoS Vulnerability

iDefense Security Advisory 07.24.07
http://labs.idefense.com/intelligence/vulnerabilities/
Jul 24, 2007

I. BACKGROUND

eTrust is an antivirus application developed by Computer Associates.
More information can be found on the vendor's website at the following
URL.

http://www3.ca.com/solutions/product.aspx?ID=156

II. DESCRIPTION

Remote exploitation of a denial of Service (DoS) vulnerability in
Computer Associates Inc.'s eTrust Antivirus products could allow
attackers to create a DoS condition on the affected computer.

When eTrust Antivirus engine scans a malformed CHM file that has an
invalid 'previous listing chunk number' field, the scanner will enter
an infinite loop and be unable to process any other files.

III. ANALYSIS

This denial of service attack will prevent the scanner from scanning
other files on disk while it is stuck on the exploit file. The hung
process can be quit by the user and does not consume all system
resources.

IV. DETECTION

iDefense has confirmed this vulnerability in eTrust AntiVirus version
r8. Previous versions of eTrust Antivirus are suspected vulnerable.
Other Computer Associates products, as well as derived products, may
also be vulnerable.

V. WORKAROUND

iDefense is not aware of any workarounds for this issue.

VI. VENDOR RESPONSE

Computer Associates has addressed this vulnerability by releasing
updates. These updates are available via the products' automatic update
features. More information is available within Computer Associates
advisory at the following URL.

http://supportconnectw.ca.com/public/antivirus/infodocs/caprodarclib-secnot.asp

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2007-3875 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

01/16/2007  Initial vendor notification
01/17/2007  Initial vendor response
07/24/2007  Coordinated public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright © 2007 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
 There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.