PT-2006-6603 · Grisoft · Avg Anti-Virus

Sergio Alvarez · Published 2006-11-16 · Updated 2016-11-18 · CVE-2006-5937

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Grisoft AVG Anti-Virus versions prior to 7.1.407

Description The issue is related to multiple integer overflows that can be triggered by crafted archives, specifically CAB or RAR archives, leading to a heap-based buffer overflow. This can allow remote attackers to execute arbitrary code.

Recommendations For versions prior to 7.1.407, update to version 7.1.407 or later to resolve the issue. As a temporary workaround, consider avoiding the use of CAB or RAR archives until the update is applied. Restrict access to the archive handling module to minimize the risk of exploitation.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2006-5937

Affected Products

Avg Anti-Virus

References · 5

• http://grisoft.com/doc/36365/lng/us/tpl/tpl01 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-5937 · Security Note
• http://secunia.com/advisories/22811 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4498 · Note
• http://marc.info/?l=full-disclosure&m=116343152030074&w=2 · Note