FullDisclosure: [Fulldisclosure] Secunia Research: HAURI AntiVirus ALZ Archive Handling Buffer Overflow
[Fulldisclosure] Secunia Research: HAURI AntiVirus ALZ Archive Handling Buffer Overflow
Source: http://www.derkeiler.com/MailingLists/FullDisclosure/200510/0166.html
From: Secunia Research (vuln_at_secunia.com) Date: 10/06/05
To: fulldisclosure@lists.grok.org.uk Date: Thu, 06 Oct 2005 17:18:30 +0200
====================================================================== Secunia Research 06/10/2005 HAURI AntiVirus ALZ Archive Handling Buffer Overflow ====================================================================== Table of Contents Affected Software..1 Severity...2 Description of Vulnerability...3 Solution...4 Time Table...5 Credits..6 References...7 About Secunia...8 Verification..9 ====================================================================== 1) Affected Software ViRobot Expert 4.0 ViRobot Advanced Server HAURI LiveCall With vrAZMain.dll version 5.8.22.137. Prior versions may also be affected. ====================================================================== 2) Severity Rating: Highly Critical Impact: System access [Fulldisclosure] Secunia Research: HAURI AntiVirus ALZ Archive Handling Buffer Overflow 1
FullDisclosure: [Fulldisclosure] Secunia Research: HAURI AntiVirus ALZ Archive Handling Buffer Overflow Where: Remote ====================================================================== 3) Description of Vulnerability Secunia Research has discovered a vulnerability in various HAURI antivirus products, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error in the archive decompression library when reading the filename of a compressed file from an ALZ archive. This can be exploited to cause a stackbased buffer overflow when a malicious ALZ archive is scanned. Successful exploitation allows arbitrary code execution, but requires that compressed file scanning is enabled. ====================================================================== 4) Solution Apply updates. ViRobot Expert 4.0 / ViRobot Advanced Server: Update to the latest version via online update. (vrAZMain.dll version 5.9.22.154) HAURI LiveCall: Update to the latest version by visiting the vendor's LiveCall website. (vrAZMain.dll version 5.9.22.154) ====================================================================== 5) Time Table 19/09/2005 Initial vendor notification. 19/09/2005 Initial vendor reply. 04/10/2005 Notified by vendor that fixed version is available via online update on 27/09/2005. 06/10/2005 Public disclosure. ====================================================================== 6) Credits Discovered by Tan Chew Keong, Secunia Research. ====================================================================== 7) References No references available. ====================================================================== 8) About Secunia [Fulldisclosure] Secunia Research: HAURI AntiVirus ALZ Archive Handling Buffer Overflow 2
FullDisclosure: [Fulldisclosure] Secunia Research: HAURI AntiVirus ALZ Archive Handling Buffer Overflow Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/200547/advisory/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ====================================================================== _______________________________________________ FullDisclosure We believe in it. Charter: http://lists.grok.org.uk/fulldisclosurecharter.html Hosted and sponsored by Secunia http://secunia.com/

SecurityFocus Bugtraq: Secunia Research: HAURI AntiVirus ACE Archive Handling Buffer Overflow
Secunia Research: HAURI AntiVirus ACE Archive Handling Buffer Overflow
Source: http://www.derkeiler.com/MailingLists/securityfocus/bugtraq/200508/0314.html
From: Secunia Research (vuln_at_secunia.com) Date: 08/24/05
To: fulldisclosure@lists.grok.org.uk Date: Wed, 24 Aug 2005 10:29:52 +0200
====================================================================== Secunia Research 24/08/2005 HAURI AntiVirus ACE Archive Handling Buffer Overflow ====================================================================== Table of Contents Affected Software..1 Severity...2 Description of Vulnerability...3 Solution...4 Time Table...5 Credits..6 References...7 About Secunia...8 Verification..9 ====================================================================== 1) Affected Software ViRobot Expert 4.0 ViRobot Advanced Server ViRobot Linux Server 2.0 HAURI LiveCall Other versions may also be affected. ====================================================================== 2) Severity Rating: Highly Critical Impact: System access Where: Remote Secunia Research: HAURI AntiVirus ACE Archive Handling Buffer Overflow 1
SecurityFocus Bugtraq: Secunia Research: HAURI AntiVirus ACE Archive Handling Buffer Overflow ====================================================================== 3) Description of Vulnerability Secunia Research has discovered a vulnerability in various HAURI antivirus products, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error in the ACE archive decompression library vrAZace.dll when extracting an archive. This can be exploited to cause a stackbased buffer overflow when scanning a malicious ACE archive containing a compressed file with a filename longer than 272 characters. Successful exploitation allows arbitrary code execution, but requires that compressed file scanning is enabled. The vulnerability is related to: http://secunia.com/SA14359 ====================================================================== 4) Solution Apply patches. ViRobot Linux Server 2.0: http://www.globalhauri.com/html/download/down_unixpatch.html ViRobot Expert 4.0 / ViRobot Advanced Server: Update to the latest version via online update (vrazmain.dll version 5.8.22.137). HAURI LiveCall: Update to the latest version by visiting the vendor's LiveCall website (vrazmain.dll version 5.8.22.137). ====================================================================== 5) Time Table 15/08/2005 Initial vendor notification. 17/08/2005 Vendor released patch for VR Linux Server. 23/08/2005 Vendor released patch for VR Expert, VR Advanced Server and LiveCall via online update. 24/08/2005 Public disclosure. ====================================================================== 6) Credits Discovered by Tan Chew Keong, Secunia Research. ====================================================================== 7) References Secunia Research: HAURI AntiVirus ACE Archive Handling Buffer Overflow 2
SecurityFocus Bugtraq: Secunia Research: HAURI AntiVirus ACE Archive Handling Buffer Overflow HAURI: http://www.globalhauri.com/html/download/down_unixpatch.html ====================================================================== 8) About Secunia Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/200533/advisory/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================