====================================================================== Secunia Research 13/10/2005 - AhnLab V3 Antivirus ALZ/UUE/XXE Archive Handling Buffer Overflow - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Description of Vulnerability.........................................3 Solution.............................................................4 Time Table...........................................................5 Credits..............................................................6 References...........................................................7 About Secunia........................................................8 Verification.........................................................9 ====================================================================== 1) Affected Software AhnLab V3Pro 2004 (V3 VirusBlock 2005 international) (Build 6.0.0.457) AhnLab V3Net for Windows Server 6.0 (Build 6.0.0.457) AhnLab MyV3 with AzMain.dll 1.3.11.15 Prior versions may also be affected. ====================================================================== 2) Severity Rating: Highly critical Impact: System access Where: Remote ====================================================================== 3) Description of Vulnerability Secunia Research has discovered a vulnerability in AhnLab V3 Antivirus, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error in the archive decompression library when reading the filename of a compressed file from an ALZ, UUE or XXE archive. This can be exploited to cause a stack-based buffer overflow (ALZ), or a heap-based buffer overflow (UUE/XXE), when a malicious ALZ/UUE/XXE archive is scanned. Successful exploitation allows arbitrary code execution, but requires that compressed file scanning is enabled. ====================================================================== 4) Solution AhnLab V3Pro 2004 (V3 VirusBlock 2005 international): Update to version 6.0.0.488 via Smart Update. AhnLab V3Net for Windows Server 6.0: Update to version 6.0.0.488 via Smart Update. AhnLab MyV3: The vulnerability has reportedly been fixed in the vendor's Korean MyV3 website. ====================================================================== 5) Time Table 19/09/2005 - Initial vendor notification. 20/09/2005 - Initial vendor response. 13/10/2005 - Vendor releases advisory. 13/10/2005 - Public disclosure. ====================================================================== 6) Credits Discovered by Tan Chew Keong, Secunia Research. ====================================================================== 7) References AhnLab: http://global.ahnlab.com/security/security_advisory002.html ====================================================================== 8) About Secunia Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2005-48/advisory/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================