PT-2005-3299 · Avast · Avast Antivirus

Published 2005-07-27 · Updated 2008-09-05 · CVE-2005-2385

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions avast! Antivirus Home/Professional Edition versions 4.6.665 avast! Antivirus Server Edition version 4.6.460

Description The issue is related to a buffer overflow in a third-party compression library, specifically UNACEV2.DLL, which is used in avast! Antivirus. This buffer overflow can be triggered by an ACE archive that contains a long filename, allowing remote attackers to execute arbitrary code.

Recommendations For avast! Antivirus Home/Professional Edition version 4.6.665, update to a version that does not use the vulnerable UNACEV2.DLL library. For avast! Antivirus Server Edition version 4.6.460, update to a version that does not use the vulnerable UNACEV2.DLL library. As a temporary workaround, consider avoiding the use of ACE archives until a patch is available.

Fix

Related Identifiers

CVE-2005-2385

Affected Products

Avast Antivirus

References · 5

• http://secunia.com/advisories/15776 · Vendor Advisory
• http://secunia.com/secunia_research/2005-20/advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2385 · Security Note
• http://securitytracker.com/id?1014544 · Note
• http://avast.com/eng/av4_revision_history.html · Note