// back

Computer Associates AntiVirus CHM File Handling DoS Vulnerability

BACKGROUND

eTrust is an antivirus application developed by Computer Associates. More information can be found on the vendor's website at the following URL.

http://www3.ca.com/solutions/product.aspx?ID=156

DESCRIPTION

Remote exploitation of a denial of Service (DoS) vulnerability in Computer Associates Inc.'s eTrust Antivirus products could allow attackers to create a DoS condition on the affected computer.

When eTrust Antivirus engine scans a malformed CHM file that has an invalid 'previous listing chunk number' field, the scanner will enter an infinite loop and be unable to process any other files.

ANALYSIS

This denial of service attack will prevent the scanner from scanning other files on disk while it is stuck on the exploit file. The hung process can be quit by the user and does not consume all system resources.

DETECTION

iDefense has confirmed this vulnerability in eTrust AntiVirus version r8. Previous versions of eTrust Antivirus are suspected vulnerable. Other Computer Associates products, as well as derived products, may also be vulnerable.

WORKAROUND

iDefense is not aware of any workarounds for this issue.

VENDOR RESPONSE

Computer Associates has addressed this vulnerability by releasing updates. These updates are available via the products' automatic update features. More information is available within Computer Associates advisory at the following URL.

http://supportconnectw.ca.com/public/antivirus/infodocs/caprodarclib-secnot.asp

CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2007-3875 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.

DISCLOSURE TIMELINE

01/16/2007 Initial vendor notification
01/17/2007 Initial vendor response
07/24/2007 Coordinated public disclosure

CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

LEGAL NOTICES

Copyright © 2007 Verisign, Inc.

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customer service for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.