Symantec AntiVirus RAR文件解压缓冲器溢出漏洞

漏洞类别：	临界条件漏洞
攻击类型：	远程攻击
发布日期：	2005-12-20
更新日期：	2005-12-20
受影响系统：	Symantec AntiVirus Corporate Edition 10.x Symantec AntiVirus Corporate Edition 8.x Symantec AntiVirus Corporate Edition 9.x Symantec AntiVirus for Caching 4.x Symantec AntiVirus for Network Attached Storage 4.x Symantec AntiVirus for SMTP Gateways 3.x Symantec AntiVirus Scan Engine 4.x Symantec AntiVirus/Filtering for Domino 3.x Symantec Brightmail AntiSpam 4.x Symantec Brightmail AntiSpam 5.x Symantec Brightmail AntiSpam 6.x Symantec Client Security 1.x Symantec Client Security 2.x Symantec Mail Security for Domino 4.x Symantec Mail Security for Exchange 4.x Symantec Mail Security for SMTP 4.x Symantec Norton AntiVirus 2001 Symantec Norton AntiVirus 2002 Symantec Norton AntiVirus 2003 Symantec Norton AntiVirus 2004 Symantec Norton AntiVirus 2005 Symantec Norton AntiVirus 5 Symantec Norton AntiVirus 5.0 for OS/2 Symantec Norton AntiVirus Corporate Edition 7.x Symantec Norton AntiVirus for Macintosh 10.x Symantec Norton AntiVirus for Macintosh 9.x Symantec Norton AntiVirus for Microsoft Exchange 2.x Symantec Norton AntiVirus for Microsoft Exchange 3.x Symantec Norton AntiVirus Solution 7.5 Symantec Norton Internet Security 2001 Symantec Norton Internet Security 2002 Symantec Norton Internet Security 2003 Symantec Norton Internet Security 2003 Professional Symantec Norton Internet Security 2004 Symantec Norton Internet Security 2004 Professional Symantec Norton Internet Security 2005 Symantec Norton Internet Security for Macintosh 3.x Symantec Web Security 2.x Symantec Web Security 3.x
安全系统：	无
漏洞报告人：	Alex Wheeler
漏洞描述：	Secunia Advisory: SA18131 Alex Wheeler已经报道了在Symantec AntiVirus中的漏洞，可被恶意攻击者利用威胁用户的系统。漏洞的发生是由于当拷贝数据基于一个PAR存档文件sub-block页眉的字长域时，在Dec2Rar.dll中的临界错误。可被利用引起基于堆积的缓冲器溢出和当扫描恶意PAR文件时潜在的执行任意代码。已经报道了在3.2.14.3版本中的漏洞，也可能影响所有使用DLL的Symantec产品。
测试方法：	无
解决方法：	在邮件或代理器网关过滤PAR文件。