Trend Micro扫描引擎UPX压缩PE文件缓冲区溢出漏洞

Trend Micro病毒扫描引擎为桌面、服务器和网关提供杀毒功能。 Trend Micro的病毒扫描引擎在扫描特制的畸形UPX压缩可执行程序时没有正确验证输入，远程攻击者可能利用此漏洞在服务器上执行任意指令。 如果用户扫描了畸形文件的话，就可能触发缓冲区溢出，导致执行任意指令。在Windows下扫描引擎在内核环境中运行；在Linux下扫描引擎运行为超级用户权限的守护程序。因此，成功利用这个漏洞的攻击者可以获得对受影响系统的完全控制。 Trend Micro Scan Engine 8.300 Trend Micro Scan Engine 8.000...

Analysis of black anti-CD QQ black hand-vulnerability warning-the black bar safety net

Look at the hack line of Defense for the official announcement, 6 issues disc this month I promote the column, the moving network vulnerabilities using the animation included with the tool will make the antivirus Alarm, tips for Trojan-PSW. Win32. QQShou. ed. A thought, my old magic computer blac...

SOL6806 - ClamAV UPX heap overflow Vulnerability - CVE-2006-4018

The FirePass controller can be configured to provide anti-virus scanning of files uploaded through Portal Access through the ClamAV open source software. A vulnerability in ClamAV 0.88.4 and earlier versions could allow a remote attacker to crash the scanner process or execute code remotely using...

Mandrake Linux Security Advisory : clamav (MDKSA-2006:138)

Damian Put discovered a boundary error in the UPX extraction module in ClamAV which is used to unpack PE Windows executables. This could be abused to cause a Denial of Service issue and potentially allow for the execution of arbitrary code with the permissions of the user running clamscan or clam...

Clam AntiVirus处理UPX压缩PE文件构建堆溢出漏洞

Clam AntiVirus是一款UNIX环境下开源的防病毒软件。 Clam AntiVirus在处理畸形UPX压缩的文件时存在堆溢出漏洞，远程攻击者可能利用此漏洞完全控制查毒机器。 Clam AntiVirus的pefromupx函数在处理UPX格式压缩的文件构建PE文件时存在堆溢出问题，远程攻击者可能通过恶意的UPX文件在查毒机器上执行任意指令。 ClamAV ClamAV 0.88.3 ClamAV ClamAV 0.88.2 目前厂商已经在0.88.4及以上版本的软件中修补了这个安全问题，请到厂商的主页下载： http://www.clamav.net/...

Debian DSA-1153-1 : clamav - buffer overflow

Damian Put discovered a heap overflow vulnerability in the UPX unpacker of the ClamAV anti-virus toolkit which could allow remote attackers to execute arbitrary code or cause denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-947-2 : clamav - heap overflow

A heap overflow has been discovered in ClamAV, a virus scanner, which could allow an attacker to execute arbitrary code by sending a carefully crafted UPX-encoded executable to a system running ClamAV. In addition, other potential overflows have been corrected. Packages for the ARM architecture...

[SECURITY] [DSA 1153-1] New ClamAV packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1153-1 [email protected] http://www.debian.org/security/ Martin Schulze August 18th, 2006 http://www.debian.org/security/faq -...

DSA-1153 clamav - buffer overflow

Bulletin has no description...

FreeBSD : clamav -- heap overflow vulnerability (342d2e48-26db-11db-9275-000475abc56f)

"Clamav team reports : A heap overflow vulnerability was discovered in libclamav which could cause a denial of service or allow the execution of arbitrary code. The problem is specifically located in the PE file rebuild function used by the UPX unpacker. Relevant code from libclamav/upx.c :...

ClamAV antivirus buffer overflow

Buffer overflow on parsing UPX-compressed PE files...

[Full-disclosure] [Overflow.pl] Clam AntiVirus Win32-UPX Heap Overflow

Overflow.pl Security Advisory 6 Clam AntiVirus Win32-UPX Heap Overflow Vendor: Clam AntiVirus Affected version: Prior to 0.88.4 Vendor status: Fixed version released 0.88.4 Author: Damian Put [email protected] URL: http://www.overflow.pl/adv/clamavupxheap.txt Date: 09.08.2006 1. Background "Clam...

CVE-2006-4018

Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus ClamAV 0.81 through 0.88.3 allows remote attackers to execute arbitrary code via a crafted UPX packed file containing sections with large rsize values...

CVE-2006-4018

Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus ClamAV 0.81 through 0.88.3 allows remote attackers to execute arbitrary code via a crafted UPX packed file containing sections with large rsize values...

CVE-2006-4018

CVE-2006-4018 is a heap-based buffer overflow in the UPX unpacker (libclamav/upx.c) of ClamAV 0.81–0.88.3, exploitable by a crafted UPX-packed file to potentially execute arbitrary code or cause a crash. Public references describe an unauthenticated remote attack via specially formed UPX files, a...

ClamAV: Heap buffer overflow

Background ClamAV is a GPL virus scanner. Description Damian Put has discovered a boundary error in the pefromupx function used by the UPX extraction module, which unpacks PE Windows executable files. Both the "clamscan" command-line utility and the "clamd" daemon are affected. Impact By sending ...

Analysis of black anti-CD QQ black hand-vulnerability warning-the black bar safety net

Article author: 混世魔王 QQ: 2 6 8 3 6 6 5 9 Information source: evil octal information security team www.eviloctal.com） Note: this article has been published in the hacker defence magazine cheat money, master skip, there are deficiencies, but also look pointing. Look at the hack line of Defense for...

ClamAV < 0.88.4 UPX rsize Content-Parsing Overflow (deprecated)

Binary data 3701.prm...

clamav -- heap overflow vulnerability

Clamav team reports: A heap overflow vulnerability was discovered in libclamav which could cause a denial of service or allow the execution of arbitrary code. The problem is specifically located in the PE file rebuild function used by the UPX unpacker. Relevant code from libclamav/upx.c: memcpyds...

Clam Anti-Virus ClamAV 0.88.x - UPX Compressed PE File Heap Buffer Overflow

source: https://www.securityfocus.com/bid/19381/info ClamAV is prone to a heap buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. This issue occurs when the application attempts to handle compresse...