======================================================================
Secunia Research 24/08/2005
- HAURI Anti-Virus ACE Archive Handling Buffer Overflow -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9
======================================================================
1) Affected Software
ViRobot Expert 4.0
ViRobot Advanced Server
ViRobot Linux Server 2.0
HAURI LiveCall
Other versions may also be affected.
======================================================================
2) Severity
Rating: Highly Critical
Impact: System access
Where: Remote
======================================================================
3) Description of Vulnerability
Secunia Research has discovered a vulnerability in various HAURI
anti-virus products, which can be exploited by malicious people to
compromise a vulnerable system.
The vulnerability is caused due to a boundary error in the ACE
archive decompression library vrAZace.dll when extracting an archive.
This can be exploited to cause a stack-based buffer overflow when
scanning a malicious ACE archive containing a compressed file with
a filename longer than 272 characters.
Successful exploitation allows arbitrary code execution, but requires
that compressed file scanning is enabled.
The vulnerability is related to:
http://secunia.com/SA14359
======================================================================
4) Solution
Apply patches.
ViRobot Linux Server 2.0:
http://www.globalhauri.com/html/download/down_unixpatch.html
ViRobot Expert 4.0 / ViRobot Advanced Server:
Update to the latest version via online update (vrazmain.dll
version 5.8.22.137).
HAURI LiveCall:
Update to the latest version by visiting the vendor's LiveCall
website (vrazmain.dll version 5.8.22.137).
======================================================================
5) Time Table
15/08/2005 - Initial vendor notification.
17/08/2005 - Vendor released patch for VR Linux Server.
23/08/2005 - Vendor released patch for VR Expert, VR Advanced Server
and LiveCall via online update.
24/08/2005 - Public disclosure.
======================================================================
6) Credits
Discovered by Tan Chew Keong, Secunia Research.
======================================================================
7) References
HAURI:
http://www.globalhauri.com/html/download/down_unixpatch.html
======================================================================
8) About Secunia
Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:
http://secunia.com/
Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/secunia_security_advisories/
======================================================================
9) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2005-33/advisory/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
--
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an
Anti-Virus product which automatically notifies the perceived sender of a
message it believes is infected may well cause more harm than good. Someone who
did not actually send you a virus may receive the notification and scramble
their support staff to find an infection which never existed in the first
place. Suggest such notifications be disabled by whomever is responsible for
your AV, or at least that the idea is considered.
--
