CVE-2005-1530
CVSS5.0
发布时间 :2005-07-19 00:00:00
修订时间 :2008-09-05 16:49:24
NMCOPS    

[原文]Sophos Anti-Virus 5.0.1, with "Scan inside archive files" enabled, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a Bzip2 archive with a large 'Extra field length' value.


[CNNVD]Sophos Anti-Virus BZip2 拒绝服务漏洞(CNNVD-200507-221)

        Sophos Anti-Virus是一款适用于多种操作系统的杀毒软件。
        Sophos Anti-Virus 5.0.1版本存在拒绝服务漏洞。
        在引擎开启"扫描压缩文件"功能后,允许远程攻击者通过一个设置了超大"Extra field length"值的BZip2压缩文件,使杀毒引擎在扫描该文件时陷入死循环,导致CPU资源耗尽从而拒绝服务。
        

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: NONE [不会对系统完整性产生影响]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:sophos:sophos_mailmonitor_for_notes_domino
cpe:/a:sophos:sophos_anti-virus:3.78dSophos Sophos Anti-Virus 3.78d
cpe:/a:sophos:sophos_puremessage_anti-virus:4.6
cpe:/a:sophos:sophos_mailmonitor:2.1
cpe:/a:sophos:sophos_anti-virus:3.82Sophos Sophos Anti-Virus 3.82
cpe:/a:sophos:sophos_anti-virus:3.84Sophos Sophos Anti-Virus 3.84
cpe:/a:sophos:sophos_anti-virus:3.78Sophos Sophos Anti-Virus 3.78
cpe:/a:sophos:sophos_anti-virus:3.91Sophos Sophos Anti-Virus 3.91
cpe:/a:sophos:sophos_anti-virus:3.86Sophos Sophos Anti-Virus 3.86
cpe:/a:sophos:sophos_anti-virus:3.4.6Sophos Sophos Anti-Virus 3.4.6
cpe:/a:sophos:sophos_anti-virus:3.83Sophos Sophos Anti-Virus 3.83
cpe:/a:sophos:sophos_small_business_suite:1.0
cpe:/a:sophos:sophos_anti-virus:3.80Sophos Sophos Anti-Virus 3.80
cpe:/a:sophos:sophos_anti-virus:3.81Sophos Sophos Anti-Virus 3.81
cpe:/a:sophos:sophos_anti-virus:3.85Sophos Sophos Anti-Virus 3.85
cpe:/a:sophos:sophos_anti-virus:3.90Sophos Sophos Anti-Virus 3.90
cpe:/a:sophos:sophos_anti-virus:3.79Sophos Sophos Anti-Virus 3.79
cpe:/a:sophos:sophos_mailmonitor:2.0
cpe:/a:sophos:sophos_anti-virus:5.0.1Sophos Sophos Anti-Virus 5.0.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1530
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1530
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200507-221
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/xforce/xfdb/21373
(PATCH)  XF  sophos-bzip2-dos(21373)
http://www.securityfocus.com/bid/14270
(PATCH)  BID  14270
http://www.idefense.com/application/poi/display?id=283&type=vulnerabilities&flashstatus=true
(VENDOR_ADVISORY)  IDEFENSE  20050714 Sophos Anti-Virus Zip File Handling DoS Vulnerability
http://securitytracker.com/id?1014488
(UNKNOWN)  SECTRACK  1014488

- 漏洞信息

Sophos Anti-Virus BZip2 拒绝服务漏洞
中危 其他
2005-07-19 00:00:00 2006-08-16 00:00:00
远程  
        Sophos Anti-Virus是一款适用于多种操作系统的杀毒软件。
        Sophos Anti-Virus 5.0.1版本存在拒绝服务漏洞。
        在引擎开启"扫描压缩文件"功能后,允许远程攻击者通过一个设置了超大"Extra field length"值的BZip2压缩文件,使杀毒引擎在扫描该文件时陷入死循环,导致CPU资源耗尽从而拒绝服务。
        

- 公告与补丁

        目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:
        http://www.sophos.com/support/

- 漏洞信息 (F38715)

iDEFENSE Security Advisory 2005-07-14.t (PacketStormID:F38715)
2005-07-15 00:00:00
iDefense Labs  idefense.com
advisory,remote,denial of service,virus
CVE-2005-1530
[点击下载]

iDEFENSE Security Advisory 07.14.05 - Remote exploitation of a denial of service vulnerability in Sophos Plc.'s Sophos Anti-Virus engine allows attackers to exhaust CPU resources on the target system and prevent further scans.

Sophos Anti-Virus Zip File Handling DoS Vulnerability

iDEFENSE Security Advisory 07.14.05
www.idefense.com/application/poi/display?id=283&type=vulnerabilities
July 14, 2005

I. BACKGROUND

Sophos Small Business Suite includes the Sophos PureMessage Small
Business Edition, combining virus and spam protection for the email
gateway, and Sophos Anti-Virus Small Business Edition, which offers
desktop and server defense against the virus threat. More information
is available at:

    http://www.sophos.com

II. DESCRIPTION

Remote exploitation of a denial of service vulnerability in
Sophos Plc.'s Sophos Anti-Virus engine allows attackers to exhaust CPU
resources on the target system and prevent further scans.

The problem specifically exists in the handling of Zip files compressed
using the BZIP2 algorithm. When scanning within a BZIP2 archive the
Sophos engine will not perform any sanity checks on the 'Extra field
length' value. By specifying an abnormally large value for this field
the analysis routine is forced into an infinite loop leading to CPU
exhaustion. The following is a hex dump of an example file that will
trigger the issue:

00  50 4b 03 04 0a 00 00 00  0c 00 5c 84 67 32 5b 26  |PK........\.g2[&|
10  b9 09 01 00 00 00 01 00  00 00 03 00 ff ff 66 6f  |..............fo|
20  6f 55 54 09 00 03 a0 74  2c 42 a1 74 2c 42 55 78  |oUT....t,B.t,BUx|
30  04 00 e8 03 e8 03 2a 50  4b 01 02 17 03 0a 00 00  |......*PK.......|
40  00 00 00 5c 84 67 32 5b  26 b9 09 01 00 00 00 01  |...\.g2[&.......|
50  00 00 00 03 00 0d 00 00  00 00 00 01 00 00 00 a4  |................|
60  81 00 00 00 00 66 6f 6f  55 54 05 00 03 a0 74 2c  |.....fooUT....t,|
70  42 55 78 00 00 50 4b 05  06 00 00 00 00 01 00 01  |BUx..PK.........|
80  00 3e 00 00 00 37 00 00  00 00 00                 |.>...7.....|
      
Bytes 08-09: Compression method - 0x000c == BZIP2 algorithm
Bytes 28-29: Extra field length - 0xffff
      
The function BZ2_decompress(), among others, is called within the
infinite loop.

III. ANALYSIS
      
Successful exploitation allows remote attackers to trigger a denial of
service condition on the target system. Remote exploitation can be
achieved by sending a malicious file in an e-mail message or during an
HTTP session. Exploitation is only possible if the 'Scan inside archive
files' option is enabled. This is not a default option but is a common
setting. Both Unix and Windows systems running a vulnerable version of
Sophos Anti-Virus are affected.

IV. DETECTION

iDEFENSE has confirmed the existence of this vulnerability against
Sophos Anti-Virus version 5.0.1. Exploitation is reliant on the
non-default option "Scan inside archive files" found under the
"On-access scanning" configuration panel. It has been reported that
Sophos Anti-Virus versions 3.91 and 3.90 are also vulnerable. It is
suspected that earlier versions are also susceptible to exploitation.
The vulnerability exists across both the Unix and Microsoft Windows
platforms.

V. WORKAROUND

Disable the "Scan inside archive files" option until a vendor fix is
made available.

VI. VENDOR RESPONSE

"We have now included protection against this vulnerability into the
latest versions of Sophos Anti-Virus on Windows, UNIX, Linux, Netware,
OpenVMS and Mac OSX (version 3.95.0 on all those platforms as well as
version 5.0.4 on Windows 2000/XP/2003 and versions 4.5.3 on Windows NT
and Windows 95/98/Me) as well as into the latest updated versions of
PureMessage for UNIX, PureMessage for Windows/Exchange and MailMonitor
(any version running anti-virus engine 2.30.4 or above)

All of these versions would be updated automatically to customers using
our automatic updating through EM Library or direct from Sophos.

They are also available to customers to download at
http://www.sophos.com/support/updates"

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-1530 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

05/12/2005  Initial vendor notification
05/16/2005  Initial vendor response
07/14/2005  Public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
    

- 漏洞信息

17910
Sophos Anti-Virus BZIP Archive Processing DoS
Denial of Service
Loss of Availability

- 漏洞描述

- 时间线

2005-07-14 Unknow
Unknow Unknow

- 解决方案

Products

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Sophos Anti-Virus BZip2 Archive Handling Remote Denial Of Service Vulnerability
Failure to Handle Exceptional Conditions 14270
Yes No
2005-07-14 12:00:00 2009-07-12 04:06:00
The individual or group that discovered this vulnerability wishes to remain anonymous.

- 受影响的程序版本

Sophos Small Business Suite 1.0
+ Sophos Anti-Virus 3.85
+ Sophos Anti-Virus 3.84
+ Sophos Anti-Virus 3.83
+ Sophos Anti-Virus 3.82
+ Sophos Anti-Virus 3.81
+ Sophos Anti-Virus 3.80
Sophos PureMessage Anti-Virus 4.6
Sophos MailMonitor for SMTP 2.1
Sophos MailMonitor for SMTP 2.0
Sophos MailMonitor for Notes/Domino
Sophos Anti-Virus 5.0.1
Sophos Anti-Virus 3.95
Sophos Anti-Virus 3.91
Sophos Anti-Virus 3.90
Sophos Anti-Virus 3.86
Sophos Anti-Virus 3.85
Sophos Anti-Virus 3.84
Sophos Anti-Virus 3.83
Sophos Anti-Virus 3.82
Sophos Anti-Virus 3.81
Sophos Anti-Virus 3.80
Sophos Anti-Virus 3.79
Sophos Anti-Virus 3.78 d
Sophos Anti-Virus 3.78
Sophos Anti-Virus 3.4.6
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0
Sophos Anti-Virus Engine 2.30.4
Sophos Anti-Virus 5.0.4
Sophos Anti-Virus 4.5.3
Sophos Anti-Virus 3.95

- 不受影响的程序版本

Sophos Anti-Virus Engine 2.30.4
Sophos Anti-Virus 5.0.4
Sophos Anti-Virus 4.5.3
Sophos Anti-Virus 3.95

- 漏洞讨论

Sophos Anti-Virus is prone to a remote denial of service vulnerability when it is configured to 'Scan inside archive files'. This is not a default setting.

The issue exists due to failure of the software to adequately sanitize 'Extra field length' values contained in BZip2 archives. Ultimately this vulnerability may be exploited to conduct a denial of proper service for legitimate users.

Attackers may leverage this issue to prevent the software from completing file scans, for files received subsequent to an attack. This may allow the attacker to bypass Anti-Virus scans.

- 漏洞利用

The following proof of concept is available; the proof of concept is a hex-dump of an archive that can be used to trigger the issue:

- 解决方案

The vendor has released updates to address this issue. These updates may be automatically applied by customers that are using the EM Library.

Additionally, these updates may be manually retrieved from the following location:

http://www.sophos.com/support/updates

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站