Trend Micro Scan Engine UPX文件解析远程拒绝服务漏洞

Trend Micro Antivirus是一款流行的反病毒解决方案。 Trend Micro Antivirus处理UPX文件存在除零错误，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 问题存在于内核驱动VsapiNT.sys中，驱动负责扫描各种文件格式中的恶意内容，解析UPX文件时获取攻击者提供文件中的整数值，结果恶意的UPX文件可导致内核模式中除零错误导致蓝屏。 Trend Micro Scan Engine 8.3 Trend Micro Scan Engine 8 Trend Micro PC-Cillin Internet Security 2006 14.10 .10...

Trend Micro VsapiNT.sys UPX File Parsing DoS

The version of Trend Micro Antivirus installed on the remote Windows host contains a divide-by-zero error in its 'VsapiNT.sys' kernel driver. Using a specially crafted UPX file, a remote attacker may be able to leverage this flaw to crash the affected host. C Tenable Network Security, Inc...

TrendMicro antivirus DoS

Division by zero on UPX packed file parsing...

JVN#80126589 CCC Cleaner division-by-zero vulnerability when scanning UPX-packed executables

Impact When CCC cleaner scans a malicious UPX-packed executable file, CCC cleaner or the system itself may crash. Solution Products Affected CCC Cleaner CCC pattern Ver:321 and earlier For more information, refer to the vendor's website...

CVE-2007-1281

Kaspersky AntiVirus Engine 6.0.1.411 for Windows and 5.5-10 for Linux allows remote attackers to cause a denial of service CPU consumption via a crafted UPX compressed file with a negative offset, which triggers an infinite loop during decompression...

CVE-2007-1281

Kaspersky AntiVirus Engine 6.0.1.411 for Windows and 5.5-10 for Linux allows remote attackers to cause a denial of service CPU consumption via a crafted UPX compressed file with a negative offset, which triggers an infinite loop during decompression...

CVE-2007-1281

The CVE-2007-1281 issue affects Kaspersky Anti-Virus Engine versions for Windows (6.0.1.411) and Linux (5.5-10). A crafted UPX-compressed file with a negative offset can trigger an infinite loop during decompression, allowing remote attackers to cause a denial of service via CPU consumption. The ...

Kaspersky AntiVirus UPX文件解压远程拒绝服务漏洞

Kaspersky Antivirus是非常流行的杀毒软件。 Kaspersky AntiVirus在处理UPX文件时存在设计错误，畸形恶意的文件导致防病毒引擎陷入死循环无法执行正常的功能。 Kaspersky Antivirus的杀毒引擎在处理UPX压缩打包的可执行程序时存在拒绝服务漏洞，畸形的压缩数据可能导致解压例程陷入死循环。具体来讲，负数数据偏移导致无限的处理同一压缩数据块。 Kaspersky Labs Kaspersky Antivirus 6.0.1.411 for Windows Kaspersky Labs Kaspersky Antivirus 5.5-10 for...

Kaspersky Anti-Virus UPX File Decompression DoS

The version of Kaspersky Anti-Virus installed on the remote host reportedly may enter an infinite loop when it attempts to process an executable with specially crafted compressed UPX data. A remote attacker may be able to exploit this issue to cause the affected host to consume all available CPU...

Kaspersky Antivirus DoS

Infinite loop on unpacking UPX-packed executable file...

iDefense Security Advisory 03.02.07: Kaspersky AntiVirus UPX File Decompression DoS Vulnerability

Kaspersky AntiVirus UPX File Decompression DoS Vulnerability iDefense Security Advisory 03.02.07 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 02, 2007 I. BACKGROUND Kaspersky Antivirus is a popular client and gateway virus scanner for Unix and Windows. UPX, the ultimate packer for...

SUSE-SA:2006:046: clamav

The remote host is missing the patch for the advisory SUSE-SA:2006:046 clamav. Damian Put discovered a bug in the UPX decoder used for scanning UPX compressed Windows executables. The bug allows for a heap buffer overflow and may potentially be exploitable to execute arbitrary code. ClamAV has be...

JVN#77366274 CCC Cleaner buffer overflow vulnerability

Impact Arbitrary code could be executed when CCC Cleaner scans UPX-packed files. Solution Products Affected CCC Cleaner CCC pattern Ver:185 CCC Cleaner is affected by this vulnerability only when the following file is contained in the "CCC Cleaner" folder. Filenames: lpt$vpn.185 As of February 13...

Buffer overflow

Buffer overflow in the Trend Micro Scan Engine 8.000 and 8.300 before virus pattern file 4.245.00, as used in other products such as Cyber Clean Center CCC Cleaner, allows remote attackers to execute arbitrary code via a malformed UPX compressed executable...

CVE-2007-0851

CVE-2007-0851 describes a buffer overflow in Trend Micro Scan Engine 8.000 and 8.300 before virus pattern file 4.245.00, exploitable when processing UPX-packed executables (as used in CCC Cleaner). The CCC Cleaner component is affected when the UPX-packed file is scanned, enabling arbitrary code ...

Trend Micro AntiVirus fails to properly process malformed UPX packed executables

Overview The Trend Micro AntiVirus scanning engine contains a buffer overflow, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Trend Micro AntiVirus is a virus scanner for Microsoft Windows and Linux. The Trend Micro virus scanning...

Trend Micro扫描引擎UPX压缩PE文件缓冲区溢出漏洞

Trend Micro病毒扫描引擎为桌面、服务器和网关提供杀毒功能。 Trend Micro的病毒扫描引擎在扫描特制的畸形UPX压缩可执行程序时没有正确验证输入，远程攻击者可能利用此漏洞在服务器上执行任意指令。 如果用户扫描了畸形文件的话，就可能触发缓冲区溢出，导致执行任意指令。在Windows下扫描引擎在内核环境中运行；在Linux下扫描引擎运行为超级用户权限的守护程序。因此，成功利用这个漏洞的攻击者可以获得对受影响系统的完全控制。 Trend Micro Scan Engine 8.300 Trend Micro Scan Engine 8.000...

Analysis of black anti-CD QQ black hand-vulnerability warning-the black bar safety net

Look at the hack line of Defense for the official announcement, 6 issues disc this month I promote the column, the moving network vulnerabilities using the animation included with the tool will make the antivirus Alarm, tips for Trojan-PSW. Win32. QQShou. ed. A thought, my old magic computer blac...

SOL6806 - ClamAV UPX heap overflow Vulnerability - CVE-2006-4018

The FirePass controller can be configured to provide anti-virus scanning of files uploaded through Portal Access through the ClamAV open source software. A vulnerability in ClamAV 0.88.4 and earlier versions could allow a remote attacker to crash the scanner process or execute code remotely using...

Mandrake Linux Security Advisory : clamav (MDKSA-2006:138)

Damian Put discovered a boundary error in the UPX extraction module in ClamAV which is used to unpack PE Windows executables. This could be abused to cause a Denial of Service issue and potentially allow for the execution of arbitrary code with the permissions of the user running clamscan or clam...