PT-2005-3765 · Eset · Eset Nod32 Antivirus

Tan Chew Keong · Published 2005-09-14 · Updated 2017-07-11 · CVE-2005-2903

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NOD32 version 2.5 with nod32.002 1.033 build 1127

Description The issue is related to a heap-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by using an ARJ archive containing a file with a long filename, exploiting the application's failure to perform proper bounds checking. The result is a loss of integrity due to arbitrary code execution.

Recommendations For NOD32 version 2.5 with nod32.002 1.033 build 1127, consider disabling active scanning until a patch is available to prevent exploitation via specially crafted ARJ archives. Restrict access to ARJ archives with long filenames to minimize the risk of arbitrary code execution.

Exploit

Fix

Related Identifiers

CVE-2005-2903

Affected Products

Eset Nod32 Antivirus

References · 7

• 🔥 http://secunia.com/secunia_research/2005-40/advisory · Exploit
• http://secunia.com/advisories/16604 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2903 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22203 · Note
• http://xforce.iss.net/xforce/xfdb/22203 · Note
• http://securityfocus.com/bid/14773 · Note
• http://marc.info/?l=bugtraq&m=112621063025054&w=2 · Note