Symantec AntiVirus Scan Engine Detection

Symantec AntiVirus Scan Engine, a TCP/IP service with a programming interface to allow integration with third-party products, is installed on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid31857; scriptversion"1.17";...

iDefense Security Advisory 02.26.08: Symantec Scan Engine 5.1.2 RAR File Denial of Service Vulnerability

iDefense Security Advisory 02.26.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 26, 2008 I. BACKGROUND Symantec Scan Engine is a standalone Anti-Virus Engine that exposes a scanning Application Programming Interface API directly to developers who wish to integrate protection into...

iDefense Security Advisory 02.26.08: Symantec Scan Engine 5.1.2 RAR File Buffer Overflow Vulnerability

iDefense Security Advisory 02.26.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 26, 2008 I. BACKGROUND Symantec Scan Engine is a standalone Anti-Virus Engine that exposes a scanning Application Programming Interface API directly to developers who wish to integrate protection into...

SuSE 10 Security Update : clamav (ZYPP Patch Number 2243)

The virus scan engine ClamAV was update to version 0.88.6. Following issues are fixed by this update : - freshclam: apply timeout patch from Everton da Silva Marques new options: ConnectTimeout and ReceiveTimeout - clamd: change stack size at the right place closes clamav bug103 -...

CVE-2007-4277

CVE-2007-4277 : Local privilege-escalation in Trend Micro’s AntiVirus engine (pre-8.550-1001) via insecure permissions on the DOS device \.\Tmfilter and an IOCTL handler (0xa0284403) that copies attacker-supplied data into a fixed-size buffer. Local users can send arbitrary content to the device,...

Trend Micro病毒扫描引擎Tmxpflt.sys多个本地安全漏洞

BUGTRAQ ID: 26209 CVECAN ID: CVE-2007-4277 Trend Micro病毒扫描引擎为桌面、服务器和网关提供杀毒功能。 Trend Micro病毒扫描引擎的驱动实现上存在多个安全漏洞，本地攻击者可能利用此漏洞提升权限。 Trend Micro的杀毒引擎中所捆绑的Tmxpflt.sys驱动中没有对\.\Tmfilter DOS设备接口设置安全的权限，允许Everyone写访问，因此任何本地登录的用户都可以访问仅有特权用户才可以访问的功能。 此外这个DOS设备接口的IOCTL...

openSUSE 10 Security Update : sylpheed-claws (sylpheed-claws-2685)

The mailreader sylpheed-claws directly links to the clamav virus scan engine. Since we released clamav 0.90 which contains a library so version change we need to release this package to align the requirements. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Symantec AntiVirus Malformed RAR and CAB Compression Type Bypass

SUMMARY Two vulnerabilities have been identified in the Symantec Decomposer component used to decompose some types of archive content while scanning for malicious content. Risk Impact High Remote Access | Yes ---|--- Local Access | No Authentication Required | No Exploit publicly available | No...

CVE-2007-1591

VsapiNT.sys in the Scan Engine 8.0 for Trend Micro AntiVirus 14.10.1041, and other products, allows remote attackers to cause a denial of service kernel fault and system crash via a crafted UPX file with a certain field that triggers a divide-by-zero error...

CVE-2007-1591

CVE-2007-1591 affects Trend Micro’s VsapiNT.sys in the Scan Engine 8.0 (Trend Micro Antivirus 14.10.1041 and similar products). A crafted UPX-packed file triggers a divide-by-zero error in VsapiNT.sys, causing a kernel fault and remote denial of service (system crash). Public references describe ...

CVE-2007-0851

Buffer overflow in the Trend Micro Scan Engine 8.000 and 8.300 before virus pattern file 4.245.00, as used in other products such as Cyber Clean Center CCC Cleaner, allows remote attackers to execute arbitrary code via a malformed UPX compressed executable...

Buffer overflow

Buffer overflow in the Trend Micro Scan Engine 8.000 and 8.300 before virus pattern file 4.245.00, as used in other products such as Cyber Clean Center CCC Cleaner, allows remote attackers to execute arbitrary code via a malformed UPX compressed executable...

CVE-2007-0851

CVE-2007-0851 describes a buffer overflow in Trend Micro Scan Engine 8.000 and 8.300 before virus pattern file 4.245.00, exploitable when processing UPX-packed executables (as used in CCC Cleaner). The CCC Cleaner component is affected when the UPX-packed file is scanned, enabling arbitrary code ...

CVE-2007-0851

Buffer overflow in the Trend Micro Scan Engine 8.000 and 8.300 before virus pattern file 4.245.00, as used in other products such as Cyber Clean Center CCC Cleaner, allows remote attackers to execute arbitrary code via a malformed UPX compressed executable...

Trend Micro扫描引擎UPX压缩PE文件缓冲区溢出漏洞

Trend Micro病毒扫描引擎为桌面、服务器和网关提供杀毒功能。 Trend Micro的病毒扫描引擎在扫描特制的畸形UPX压缩可执行程序时没有正确验证输入，远程攻击者可能利用此漏洞在服务器上执行任意指令。 如果用户扫描了畸形文件的话，就可能触发缓冲区溢出，导致执行任意指令。在Windows下扫描引擎在内核环境中运行；在Linux下扫描引擎运行为超级用户权限的守护程序。因此，成功利用这个漏洞的攻击者可以获得对受影响系统的完全控制。 Trend Micro Scan Engine 8.300 Trend Micro Scan Engine 8.000...

CVE-2006-6458

The Trend Micro scan engine before 8.320 for Windows and before 8.150 on HP-UX and AIX, as used in Trend Micro PC Cillin - Internet Security 2006, Office Scan 7.3, and Server Protect 5.58, allows remote attackers to cause a denial of service CPU consumption and system hang via a malformed RAR...

CVE-2006-6458

The CVE-2006-6458 entry affects the Trend Micro scan engine before 8.320 on Windows and before 8.150 on HP-UX/AIX, used in Trend Micro PC Cillin Internet Security 2006, Office Scan 7.3, and Server Protect 5.58. Root cause: processing a malformed RAR archive where the Archive Header head_size and ...

CVE-2006-0231

Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications...

CVE-2006-0232

Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests...

Design/Logic Flaw

Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator privileges via a modified client that sends certain XML requests...