search menu icon-carat-right cmu-wordmark

CERT Coordination Center

McAfee Scan Engine vulnerable to buffer overflow in LHA decoder

Vulnerability Note VU#361180

Original Release Date: 2005-03-18 | Last Revised: 2005-03-21

Overview

A buffer overflow vulnerability in the McAfee Virus Scan Engine may allow a remote attacker to execute arbitrary code on an affected system. Because the vulnerability exists in a core component, a number of different McAfee products are affected.

Description

The McAfee Antivirus products feature the ability to detect malicious code in a number of compressed files, including those in the LHA format. A buffer overflow error has been discovered in the way that the McAfee Scan Engine handles the "type 2" headers in an LHA file. A remote attacker with the ability to craft a specifically malfomed LHA file may be able to exploit this vulnerability by introducing the malformed LHA file to an affected system via a web or FTP server, email message, or file server.

McAfee lists the following products as being potentially vulnerable to this issue, depending on the version of the scan engine they use:

    • McAfee InternetSecurity Suite
    • VirusScan (all versions)
    • VirusScan Professional
    • Active Mail Protection
    • Active Threat Protection
    • Active Virus Defense SMB Edition
    • Active VirusScan SMB Edition
    • GroupShield for Exchange
    • GroupShield for Exchange 5.5
    • GroupShield for Lotus Domino
    • GroupShield for Mail Servers with ePO
    • LinuxShield
    • Managed VirusScan
    • NetShield for Netware
    • PortalShield for Microsoft SharePoint
    • SecurityShield for Microsoft ISA Server
    • Virex
    • VirusScan ASaP
    • VirusScan Command Line
    • VirusScan Enterprise 8.0i
    • VirusScan for NetApp
    • WebShield Appliances
    • WebShield SMTP

Impact

An unauthenticated remote attacker may be able to execute code of their choosing on a vulnerable system. The attacker-supplied code would be run with Local System privileges, resulting in a complete system compromise.

Solution

Apply an update from the vendor
McAfee has published updated versions of the Scan Engine (version 4400 - released November 2004) and DAT file (version 4436 - released March 1, 2005) to address this vulnerability. Users are encouraged to review the McAfee FAQ and McAfee advisory on this issue and update their products accordingly.

Vendor Information

361180
 
Affected   Unknown   Unaffected

McAfee

Updated:  March 21, 2005

Status

  Vulnerable

Vendor Statement

McAfee has published updated versions of the Scan Engine (version 4400 -
released November 2004) and DAT file (version 4436- released March 1
2005) to address this vulnerability. Users are encouraged to review the
McAfee FAQ <
http://us.mcafee.com/root/support.asp?id=4320_faqs>  and
McAfee advisory
<
http://images.mcafee.com/misc/McAfee_Security_Bulletin_05-march-17.pdf>
on this issue and update their products accordingly.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

The CERT/CC credits Alex Wheeler of the ISS X-Force with the discovery of this vulnerability.

This document was written by Chad R Dougherty based upon information provided by McAfee and ISS.

Other Information

CVE IDs: CVE-2005-0644
Severity Metric: 22.32
Date Public: 2005-03-18
Date First Published: 2005-03-18
Date Last Updated: 2005-03-21 19:07 UTC
Document Revision: 6

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.