Symantec AntiVirus Products RAR Archive Virus Detection Bypass

[ercolino]

Secunia Advisory: SA15153 Print Advisory
Release Date: 2005-04-28

Critical:
Moderately critical
Impact: Security Bypass
Where: From remote
Solution Status: Vendor Patch

Software: Symantec AntiVirus Scan Engine 4.x
Symantec AntiVirus/Filtering for Domino 3.x
Symantec Mail Security for Exchange 4.x
Symantec Mail Security for SMTP 4.x
Symantec Norton AntiVirus 2005
Symantec Norton Internet Security 2005
Symantec Norton SystemWorks 2005
Symantec Web Security 3.x

Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it.

Description:
André Jerleke has reported a vulnerability in various Symantec AntiVirus products, which can be exploited by malware to bypass certain scanning functionality.

The vulnerability is caused due to an error in the Symantec Antivirus component when processing encoded or archived content. This can be exploited to crash the decomposer component when parsing a specially crafted RAR file.

Successful exploitation causes malware inside the RAR file to bypass the scanning functionality.

This vulnerability primarily poses a risk in environments where virus scanning only is performed on gateway systems, as the malware still is detected by the RealTime Virus Scan / Auto-Protect functionality when extracted on systems running Symantec Antivirus.

Certain Windows builds of the following products are affected:
* Symantec Web Security
* Symantec Mail Security for SMTP
* Symantec AntiVirus Scan Engine
* Symantec SAV/Filter for Domino NT
* Symantec Mail Security for Exchange
* Symantec Norton AntiVirus 2005
* Symantec Norton Internet Security 2005
* Symantec Norton System Works 2005

NOTE: See the vendor advisory for a list of affected and fixed versions.

Solution:
Updates are available via LiveUpdate and from the Symantec Support site.
http://www.symantec.com/techsupp/

Provided and/or discovered by:
André Jerleke

Original Advisory:
Symantec:
http://securityresponse.symantec...s...005.04.27.html



http://secunia.com/advisories/15153/