29 May 2007, 10:42
Further vulnerabilities in anti-virus software
Having reported on Avast's anti-virus software, Sergio Alvarez from security company n.runs now seems to have turned his attention to Avira's Antivir product, in which he has discovered a number of security-related vulnerabilities. A buffer overflow which can be used to inject and execute code can occur when processing LZH compressed files. A division by zero can occur with UPX files and TAR files can cause the software to enter an infinite loop.
Avira has, however, been quick to react. Less than two weeks after being notified by Alvarez, the vendor has distributed AVPack version 7.03.00.09 and a new engine version 7.04.00.24, which fix the problem, to all customers.
- Avira Antivir Arbitrary Code Execution [LZH] advisory from n.runs
- Avira Antivir UPX parsing Divide by Zero advisory from n.runs
- Avira AntiVir Vulnerabilities Patrick Lichtner from Avira on the support forum
(mba)
Print Version | Send by email
| Permalink: http://h-online.com/-732955
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
