PT-2007-5740 · Sophos · Sophos Anti-Virus

Publicado 2007-08-28 · Atualizado 2018-10-15 · CVE-2007-4578

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sophos Anti-Virus for Windows and for Unix/Linux versions prior to 2.48.0

Description The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UPX packed file. This is a result of an "integer cast around". There is a discrepancy between the vendor and the researcher regarding the severity of the issue, with the vendor stating it as a denial of service and the researcher claiming it allows code execution.

Recommendations For versions prior to 2.48.0, update to version 2.48.0 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2007-4578

Produtos afetados

Sophos Anti-Virus

Referências · 11

• http://securityfocus.com/archive/1/477882/100/0/threaded · Nota
• http://vupen.com/english/advisories/2007/2972 · Nota
• http://nruns.com/security_advisory_sophos_upx_infinite_loop_dos.php · Nota
• http://securitytracker.com/id?1018608 · Nota
• http://securityfocus.com/bid/25428 · Correção
• http://securityfocus.com/archive/1/477720/100/0/threaded · Nota
• http://sophos.com/support/knowledgebase/article/28407.html · Correção
• http://secunia.com/advisories/26580 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-4578 · Nota de Segurança
• http://securityreason.com/securityalert/3072 · Nota
• http://securityfocus.com/archive/1/477864/100/0/threaded · Nota