ZDI-06-012: Sophos Anti-Virus CAB Unpacking Code Execution Vulnerability

ZDI-06-012: Sophos Anti-Virus CAB Unpacking Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-013.html May 8, 2006 -- CVE ID: CVE-2006-0994 -- Affected Vendor: Sophos Plc. -- Affected Products: Sophos Anti-Virus for Windows, Mac OS, Unix, Linux, NetWare, OS/2, OpenVM...

Sophos Anti-Virus CAB Unpacking Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sophos AntiVirus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the unpacking of Microsoft Cabinet files that contain invalid folder count values...