|
|
|
Vulnerability Note VU#361180McAfee Scan Engine vulnerable to buffer overflow in LHA decoderOverviewA buffer overflow vulnerability in the McAfee Virus Scan Engine may allow a remote attacker to execute arbitrary code on an affected system. Because the vulnerability exists in a core component, a number of different McAfee products are affected.I. DescriptionThe McAfee Antivirus products feature the ability to detect malicious code in a number of compressed files, including those in the LHA format. A buffer overflow error has been discovered in the way that the McAfee Scan Engine handles the "type 2" headers in an LHA file. A remote attacker with the ability to craft a specifically malfomed LHA file may be able to exploit this vulnerability by introducing the malformed LHA file to an affected system via a web or FTP server, email message, or file server.McAfee lists the following products as being potentially vulnerable to this issue, depending on the version of the scan engine they use:
II. ImpactAn unauthenticated remote attacker may be able to execute code of their choosing on a vulnerable system. The attacker-supplied code would be run with Local System privileges, resulting in a complete system compromise.III. SolutionApply an update from the vendor
References
The CERT/CC credits Alex Wheeler of the ISS X-Force with the discovery of this vulnerability. This document was written by Chad R Dougherty based upon information provided by McAfee and ISS.
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
Get Adobe Reader