The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Sophos Anti-Virus Petite File DoS
------------------------------------------------------------------------
SUMMARY
<http://sophos.com/> Sophos Anti-Virus is comprehensive scanning solution
used to protect users from viruses, malicious code, ad-ware, trojans, and
more.
Remote exploitation of a denial of service vulnerability in Sophos
Anti-Virus could result in unusable system conditions.
DETAILS
Vulnerable Systems:
* Sophos Anti-Virus version 5.1 for Windows.
* Sophos Anti-Virus version 5 for Linux.
The problem manifests itself when the scanning engine encounters an
executable compressed with petite that contains a large number of
sections.
Successful exploitation would result in the scanning engine attempting to
allocate an extremely large amount of memory resulting in memory
exhaustion on the system in question. The auto-scan features of Sophos
Anti-Virus will attempt to scan files on access.
Vendor Status:
Sophos <http://www.sophos.com/support/knowledgebase/article/7609.html>
recommends upgrading to an unaffected version of the scan engine.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4839>
CVE-2006-4839
Vulnerable Systems:
* 09/15/2006 - Initial vendor notification
* 09/19/2006 - Initial vendor response
* 10/31/2006 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=438>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=438
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
