Symantec Web Gateway Anti-Virus Definition < 20160628.037 Multiple Vulnerabilities (SYM16-010) (credentialed check)

According to its self-reported anti-virus definition version number, the remote web server is hosting a version of Symantec Web Gateway with an anti-virus definition version prior to 20160628.037. It is, therefore, affected by multiple vulnerabilities : - An array indexing error exists in the UnR...

Symantec Messaging Gateway 10.x < 10.6.1-4 Multiple Vulnerabilities (SYM16-010)

According to its self-reported version number, the Symantec Messaging Gateway SMG running on the remote host is 10.x prior to 10.6.1-4. It is, therefore, affected by multiple vulnerabilities : - An array indexing error exists in the UnRAR component in the Unpack::ShortLZ function in unpack15.cpp...

Symantec AntiVirus - PowerPoint Misaligned Stream-cache Remote Stack Buffer Overflow (PoC)

Symantec AntiVirus - PowerPoint Misaligned Stream-cache Remote Stack Buffer Overflow PoC Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=823 A PowerPoint PPT file is a complicated OLE compound document comprising of a series of streams. The format is described by Microsoft in...

Symantec AntiVirus - Unpacking RAR Multiple Remote Memory Corruptions

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=810 A major component of the Symantec Antivirus scan engine is the "Decomposer", responsible for unpacking various archive formats such as ZIP, RAR, and so on. The decomposer runs as NT AUTHORITY\SYSTEM on Windows, and root on Linu...

Symantec / Norton AntiVirus - ASPack Remote Heap/Pool Memory Corruption

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=820 When parsing executables packed by an early version of aspack, a buffer overflow can occur in the core Symantec Antivirus Engine used in most Symantec and Norton branded...

SymantecNorton AntiVirus - ASPack Remote HeapPool Memory Corruption

SymantecNorton AntiVirus - ASPack Remote HeapPool Memory Corruption Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=820 When parsing executables packed by an early version of aspack, a buffer overflow can occur in the core Symantec Antivirus Engine used in most Symantec and Nort...

Symantec/Norton AntiVirus - ASPack Remote Heap/Pool Memory Corruption

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=820 When parsing executables packed by an early version of aspack, a buffer overflow can occur in the core Symantec Antivirus Engine used in most Symantec and Norton branded Antivirus products. The problem occurs when section data ...

Comodo AntiVirus - Heap Overflow in LZX Decompression

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=737 LzxDecoder::init initializes the vector LzxDecoder-window to a fixed size of 2^method bytes, which is then used during LzxDecoder::Extract. It's possible for LZX compressed...

Nexpose Scan Engine on the AWS Marketplace

Rapid7 is excited to announce that you can now find a Nexpose Scan Engine AMI on the Amazon Web Services Marketplace making it simple to deploy a pre-authorized Nexpose Scan Engine from the AWS Marketplace to scan your AWS assets! What is an AMI ? An Amazon Machine Image AMI allows you to launch ...

Symantec AntiVirus Scan Engine Web Service Administrative Interface Buffer Overflow

The remote host has a version of Symantec AntiVirus Scan Engine installed that is affected by a buffer overflow vulnerability in the web-based administrative interface. By sending a specially crafted request, a remote attacker may be able to execute arbitrary code. C Tenable Network Security, Inc...

Symantec Antivirus Scan Engine RAR and CAB Parsing Multiple Vulnerabilities

The remote host is running a version of the Symantec Mail Security for Exchange / Domino that is affected by multiple vulnerabilities : - A heap overflow vulnerability exists that can be triggered when the scanning engine processes a specially crafted CAB file, possibly leading to arbitrary code...

Symantec Legacy Decomposer Code Execution (SYM12-017)

The version of Symantec Endpoint Protection or Symantec Scan Engine installed on the remote Windows host is potentially affected by a code execution vulnerability. The legacy decomposer engine fails to properly handle bounds-checking when parsing files from some versions of CAB archives. C Tenabl...

SuSE 10 Security Update : clamav (ZYPP Patch Number 6990)

Specially crafted CAB archives could crash clamav CVE-2010-1311 or bypass virus detection CVE-2010-0098. clamav has been updated to version 0.96 which fixes those issues. Citing freshmeat.net : This Release introduces new malware detection mechanisms and other significant improvements to the scan...

SuSE9 Security Update : clamav (YOU Patch Number 12610)

Specially crafted CAB archives could crash clamav CVE-2010-1311 or bypass virus detection CVE-2010-0098. clamav has been updated to version 0.96 which fixes those issues. Citing freshmeat.net : This Release introduces new malware detection mechanisms and other significant improvements to the scan...

SuSE 10 Security Update : ClamAV (ZYPP Patch Number 6983)

Specially crafted CAB archives could crash clamav CVE-2010-1311 or bypass virus detection CVE-2010-0098. clamav has been updated to version 0.96 which fixes those issues. Citing freshmeat.net : This Release introduces new malware detection mechanisms and other significant improvements to the scan...

Symantec Scan Engine Authentication Bypass (CVE-2006-0230)

Symantec Scan Engine provides virus protection services targeted at network traffic as well as data storage devices. It also provides an API in order to enable it to be integrated with third-party software and hardware devices. This product is configurable through a web interface exposed on port...

Availability of scanner helper tools

This routine checks for the presence of various tools that support the scan engine. If some tools are not accessible for the scan engine, one or more VTs could not be executed properly. The consequence might be that certain vulnerabilities or additional compliance tests are missed because...

多个Symantec产品RAR/TAR/ZIP文件扫描绕过漏洞

Bugraq ID: 35354 多个Symantec产品对畸形或特殊格式的压缩档文件如tar/zip/rar/缺少真确处理，可导致绕过扫描产品的检测。 攻击者构建恶意的文件，发送给目标用户，可绕过检测使应用程序展开并执行。 目前没有详细漏洞细节提供。 Symantec Symantec AntiVirus Scan Engine for Microsoft ISA 4.3.12 Symantec Symantec AntiVirus Corporate Edition 10.2 MR2 Symantec Scan Engine 5.1.6.31 Symantec Scan Engine...

Avira AntiVir Zip Scan Evasion

The remote host is running an Avira AntiVir product. The scan engine of the installed product is earlier than 7.9.0.148 / 8.2.0.148. Such versions reportedly fail to properly inspect specially crafted 'ZIP' files. An attacker could embed code in a ZIP file in order to circumvent detection by...

BitDefender CAB Scan Evasion

The remote version of BitDefender Antivirus is running with a signature update before April 13, 2009. Such versions are affected by a scan evasion vulnerability. An attacker can exploit this flaw to package malicious code in a specially crafted 'CAB' file so that it will not be detected by the sc...