Fergie's Tech Blog

Sophos AntiVirus Products Remote Heap Overflow Vulnerability

Via FrSIRT.

FrSIRT Advisory : FrSIRT/ADV-2005-1244
CVE Reference : GENERIC-MAP-NOMATCH
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-07-27

* Technical Description *

A critical vulnerability was identified in multiple Sophos AntiVirus products, which may be exploited by remote attackers or malware to execute arbitrary code. This flaw is due to a heap overflow error when analyzing malformed files, which may be exploited by remote attackers to execute arbitrary commands by sending a specially crafted attachment to a vulnerable system. No further details have been disclosed.

* Affected Products *

Sophos Anti-Virus versions prior to 3.96.0 (on Windows, Unix, NetWare, OS/2, OpenVMS)
Sophos Anti-Virus versions prior to 4.5.4 (on all platforms)
Sophos Anti-Virus Small Business Edition

* Solution *

Upgrade to Sophos Anti-Virus version 3.96.0 or 4.5.4 :
http://www.sophos.com/support/updates

Sophos Anti-Virus Small Business Edition will be updated by 29/07/05

* References *

http://www.frsirt.com/english/advisories/2005/1244
http://www.sophos.com/support/knowledgebase/article/3409.html

posted by Fergie @ 7/27/2005 11:54:00 AM