A buffer overflow vulnerability in the McAfee Virus Scan Engine may allow a remote attacker to execute arbitrary code on an affected system. Because the vulnerability exists in a core component, a number of different McAfee products are affected.
The McAfee Antivirus products feature the ability to detect malicious code in a number of compressed files, including those in the LHA format. A buffer overflow error has been discovered in the way that the McAfee Scan Engine handles the "type 2" headers in an LHA file. A remote attacker with the ability to craft a specifically malfomed LHA file may be able to exploit this vulnerability by introducing the malformed LHA file to an affected system via a web or FTP server, email message, or file server.
McAfee lists the following products as being potentially vulnerable to this issue, depending on the version of the scan engine they use:
An unauthenticated remote attacker may be able to execute code of their choosing on a vulnerable system. The attacker-supplied code would be run with Local System privileges, resulting in a complete system compromise.
Apply an update from the vendor
The CERT/CC credits Alex Wheeler of the ISS X-Force with the discovery of this vulnerability.
This document was written by Chad R Dougherty based upon information provided by McAfee and ISS.
|Date First Published:||2005-03-18|
|Date Last Updated:||2005-03-21 19:07 UTC|