PT-2005-3299 · Avast · Avast Antivirus

Publicado 2005-07-27 · Atualizado 2008-09-05 · CVE-2005-2385

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions avast! Antivirus Home/Professional Edition versions 4.6.665 avast! Antivirus Server Edition version 4.6.460

Description The issue is related to a buffer overflow in a third-party compression library, specifically UNACEV2.DLL, which is used in avast! Antivirus. This buffer overflow can be triggered by an ACE archive that contains a long filename, allowing remote attackers to execute arbitrary code.

Recommendations For avast! Antivirus Home/Professional Edition version 4.6.665, update to a version that does not use the vulnerable UNACEV2.DLL library. For avast! Antivirus Server Edition version 4.6.460, update to a version that does not use the vulnerable UNACEV2.DLL library. As a temporary workaround, consider avoiding the use of ACE archives until a patch is available.

Correção

Identificadores relacionados

CVE-2005-2385

Produtos afetados

Avast Antivirus

Referências · 5

• http://secunia.com/advisories/15776 · Aviso do Fabricante
• http://secunia.com/secunia_research/2005-20/advisory · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-2385 · Nota de Segurança
• http://securitytracker.com/id?1014544 · Nota
• http://avast.com/eng/av4_revision_history.html · Nota