TITLE:
F-Secure Antivirus Products Scanning Bypass Vulnerability
SECUNIA ADVISORY ID:
SA20858
VERIFY ADVISORY:
http://secunia.c
om/advisories/20858/
CRITICAL:
Moderately critical
IMPACT:
Security Bypass
WHERE:
From remote
SOFTWARE:
F-Secure Anti-Virus 2004
http://secunia.com/p
roduct/3500/
F-Secure Anti-Virus 2005
http://secunia.com/p
roduct/4299/
F-Secure Anti-Virus 2006
http://secunia.com/p
roduct/6882/
F-Secure Anti-Virus Client Security 5.x
http://secunia.com/p
roduct/2718/
F-Secure Anti-Virus Client Security 6.x
http://secunia.com/p
roduct/5786/
F-Secure Anti-Virus for Citrix Servers 5.x
http://secunia.com/p
roduct/5198/
F-Secure Anti-Virus for MIMEsweeper 5.x
http://secunia.com/pr
oduct/455/
F-Secure Anti-Virus for Windows Servers 5.x
http://secunia.com/pr
oduct/452/
F-Secure Anti-Virus for Workstations 5.x
http://secunia.com/pr
oduct/457/
F-Secure Internet Security 2004
http://secunia.com/p
roduct/3499/
F-Secure Internet Security 2005
http://secunia.com/p
roduct/4300/
F-Secure Internet Security 2006
http://secunia.com/p
roduct/6883/
F-Secure Service Platform for Service Providers (Personal
Express)
6.x
http://secunia.com/p
roduct/6885/
DESCRIPTION:
Two vulnerabilities have been reported in various F-Secure
Antivirus
products, which can be exploited by malware to bypass the
scanning
functionality.
1) An unspecified error within the handling of executable
programs
where the name has been manipulated in a certain way can be
exploited
to bypass the anti-virus scanning functionality.
2) An error causes files on removable media to not be
scanned
when
the "Scan network devices" option has been
disabled.
Successful exploitation of the vulnerabilities bypasses the
real-time
scanning functionality and may result in execution of
malware
on the
system.
SOLUTION:
Apply patches (see patch matrix in the vendor's advisory).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
F-Secure:
htt
p://www.f-secure.com/security/fsc-2006-4.shtml
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworks imagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================
|