Technical Description

A buffer overflow vulnerability was reported in several F-Secure antivirus products, and could be exploited by attackers or worms to compromise a system. This flaw resides in the F-Secure AntiVirus Library used to parse different file formats to detect malware. Before archive decompression, the library does not properly check the length of certain fields, which could be exploited to execute arbitrary code by sending an e-mail containing a crafted ARJ archive file.

Affected Products

F-Secure Anti-Virus for Workstation version 5.43 and earlier
F-Secure Anti-Virus for Windows Servers version 5.50 and earlier
F-Secure Anti-Virus for Citrix Servers version 5.50
F-Secure Anti-Virus for MIMEsweeper version 5.51 and earlier
F-Secure Anti-Virus Client Security version 5.55 and earlier
F-Secure Anti-Virus for MS Exchange version 6.31 and earlier
F-Secure Internet Gatekeeper version 6.41 and earlier
F-Secure Anti-Virus for Firewalls version 6.20 and earlier
F-Secure Internet Security 2004 and 2005
F-Secure Anti-Virus 2004 and 2005
Solutions based on F-Secure Personal Express version 5.10 and earlier
F-Secure Anti-Virus for Linux Workstations version 4.52 and earlier
F-Secure Anti-Virus for Linux Servers version 4.61 and earlier
F-Secure Anti-Virus for Linux Gateways version 4.61 and earlier
F-Secure Anti-Virus for Samba Servers version 4.60
F-Secure Anti-Virus Linux Client Security 5.01 and earlier
F-Secure Anti-Virus Linux Server Security 5.01 and earlier
F-Secure Internet Gatekeeper for Linux 2.06

Solution

F-Secure Internet Security 2004 and 2005 - Hotfix distributed automatically
F-Secure Anti-Virus 2004 and 2005 - Hotfix distributed automatically
F-Secure Personal Express 5.10 and earlier - Hotfix distributed automatically
F-Secure Anti-Virus for Workstations 5.40 - ftp://ftp.europe.f-secure.com/support/hotfix/fsav/fsavwk540-07-signed.fsfix
F-Secure Anti-Virus for Workstations 5.41 - ftp://ftp.europe.f-secure.com/support/hotfix/fsav/fsavwk541-14-signed.fsfix
F-Secure Anti-Virus for Workstations 5.42, 5.43 - ftp://ftp.europe.f-secure.com/support/hotfix/fsav/fsavwk543-01-signed.fsfix
F-Secure Anti-Virus Client Security 5.52 - ftp://ftp.europe.f-secure.com/support/hotfix/fsav/fsavwk552-12-signed.fsfix
F-Secure Anti-Virus Client Security 5.54, 5.55 - ftp://ftp.europe.f-secure.com/support/hotfix/fsav/fsavwk557-01-signed.fsfix
F-Secure Anti-Virus for Windows Servers 5.42 - 5.50 - ftp://ftp.europe.f-secure.com/support/hotfix/fsav/fsavsr551-02-signed.fsfix
F-Secure Anti-Virus for Citrix Servers 5.50 - ftp://ftp.europe.f-secure.com/support/hotfix/fsav/fsavsr551-02-signed.fsfix
F-Secure Anti-Virus for MIMEsweeper 5.42 - 5.51 - ftp://ftp.europe.f-secure.com/support/hotfix/fsav/fsavsr551-02-signed.fsfix
F-Secure Anti-Virus for MS Exchange 6.01 - ftp://ftp.f-secure.com/support/hotfix/fsav-mse/fscss631-06.zip
F-Secure Anti-Virus for MS Exchange 6.31 - ftp://ftp.f-secure.com/support/hotfix/fsav-mse/fscss641-03.zip
F-Secure Internet Gatekeeper 6.41 - ftp://ftp.f-secure.com/support/hotfix/fsig/fscss641-03.zip
F-Secure Anti-Virus for Firewalls 6.20 - ftp://ftp.f-secure.com/support/hotfix/fsav-fw/fsavfw620-07.zip
F-Secure Anti-Virus for Linux Workstations 4.52 and earlier - ftp://ftp.europe.f-secure.com/support/hotfix/fsav-linux/fsav-4.61-hotfix4.tgz
F-Secure Anti-Virus for Linux Servers 4.61 and earlier - ftp://ftp.europe.f-secure.com/support/hotfix/fsav-linux/fsav-4.61-hotfix4.tgz
F-Secure Anti-Virus for Linux Gateways 4.61 and earlier - ftp://ftp.europe.f-secure.com/support/hotfix/fsav-linux/fsav-4.61-hotfix4.tgz
F-Secure Anti-Virus for Samba Servers 4.60 and earlier - ftp://ftp.europe.f-secure.com/support/hotfix/fsav-linux/fsav-4.61-hotfix4.tgz
F-Secure Anti-Virus Linux Client Security 5.01 and earlier - ftp://ftp.europe.f-secure.com/support/hotfix/fsav-linux/fsav-5.0x-hotfix1.tgz
F-Secure Anti-Virus Linux Server Security 5.01 and earlier - ftp://ftp.europe.f-secure.com/support/hotfix/fsav-linux/fsav-5.0x-hotfix1.tgz
F-Secure Internet Gatekeeper for Linux 2.06 - ftp://ftp.europe.f-secure.com/support/hotfix/fsav-linux/fsigk-2.06-hotfix2.tgz

References

http://www.vupen.com/english/advisories/2005/0141
http://www.f-secure.com/security/fsc-2005-1.shtml
http://xforce.iss.net/xforce/alerts/id/188

Credits

Vulnerability reported by ISS

ChangeLog

2005-02-10 : Initial release
2005-02-15 : Updated CVE

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.