PT-2005-4421 · F Secure+1 · F-Secure Anti-Virus For Linux+4

Published 2005-11-18 · Updated 2017-07-11 · CVE-2005-3664

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus Engine versions 5.0.227 and earlier Kaspersky Personal version 5.0.227 Anti-Virus On-Demand Scanner for Linux version 5.0.5 F-Secure Anti-Virus for Linux version 4.50

Description The issue is related to a heap-based buffer overflow that can be triggered by a crafted CHM file, allowing remote attackers to execute arbitrary code. This is due to the Anti-Virus engine's failure to perform proper bounds checking. The result is a loss of integrity.

Recommendations For Kaspersky Anti-Virus Engine version 5.0.227, update to a version that includes proper bounds checking to prevent the heap-based buffer overflow. For Kaspersky Personal version 5.0.227, consider disabling the handling of CHM files until a patch is available. For Anti-Virus On-Demand Scanner for Linux version 5.0.5, restrict access to the Anti-Virus engine to minimize the risk of exploitation. For F-Secure Anti-Virus for Linux version 4.50, avoid using the Anti-Virus engine with untrusted CHM files until the issue is resolved.

Fix

Related Identifiers

CVE-2005-3664

Affected Products

Anti-Virus On-Demand Scanner For Linux

F-Secure Anti-Virus For Linux

Kaspersky Antivirus Engine

Kaspersky Anti-Virus

Kaspersky Personal

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2005-3664 · Security Note
• http://idefense.com/application/poi/display?id=318&type=vulnerabilities · Vendor Advisory
• http://xforce.iss.net/xforce/xfdb/22564 · Note
• http://osvdb.org/19913 · Note
• http://secunia.com/advisories/17144 · Note
• http://secunia.com/advisories/17130 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22564 · Note
• http://securityfocus.com/bid/15054 · Note
• http://osvdb.org/19912 · Note