Computer Associates AntiVirus CHM File Handling DoS Vulnerability
iDefense Security Advisory 07.24.07
http://labs.idefense.com/intelligence/vulnerabilities/
Jul 24, 2007
I. BACKGROUND
eTrust is an antivirus application developed by Computer Associates.
More information can be found on the vendor's website at the following
URL.
http://www3.ca.com/solutions/product.aspx?ID=156
II. DESCRIPTION
Remote exploitation of a denial of Service (DoS) vulnerability in
Computer Associates Inc.'s eTrust Antivirus products could allow
attackers to create a DoS condition on the affected computer.
When eTrust Antivirus engine scans a malformed CHM file that has an
invalid 'previous listing chunk number' field, the scanner will enter
an infinite loop and be unable to process any other files.
III. ANALYSIS
This denial of service attack will prevent the scanner from scanning
other files on disk while it is stuck on the exploit file. The hung
process can be quit by the user and does not consume all system
resources.
IV. DETECTION
iDefense has confirmed this vulnerability in eTrust AntiVirus version
r8. Previous versions of eTrust Antivirus are suspected vulnerable.
Other Computer Associates products, as well as derived products, may
also be vulnerable.
V. WORKAROUND
iDefense is not aware of any workarounds for this issue.
VI. VENDOR RESPONSE
Computer Associates has addressed this vulnerability by releasing
updates. These updates are available via the products' automatic update
features. More information is available within Computer Associates
advisory at the following URL.
http://supportconnectw.ca.com/public/antivirus/infodocs/caprodarclib-secnot.asp
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2007-3875 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
01/16/2007 Initial vendor notification
01/17/2007 Initial vendor response
07/24/2007 Coordinated public disclosure
IX. CREDIT
The discoverer of this vulnerability wishes to remain anonymous.
Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events
http://labs.idefense.com/
X. LEGAL NOTICES
Copyright © 2007 iDefense, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
