PT-2007-1610 · Kaspersky · Kaspersky Antivirus Engine

Published 2007-01-09 · Updated 2017-07-29 · CVE-2007-0125

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Kaspersky Labs Antivirus Engine versions 6.0 for Windows and 5.5 through 10 for Linux before 20070102

Description The issue allows remote attackers to cause a denial of service due to CPU consumption by scanning a crafted portable executable file. This occurs when the software encounters an invalid NumberOfRvaAndSizes value in the Optional Windows Header of a PE file, resulting in an infinite loop.

Recommendations For Kaspersky Labs Antivirus Engine versions 6.0 for Windows and 5.5 through 10 for Linux before 20070102, update to a version released after 20070102 to resolve the issue.

Fix

Related Identifiers

CVE-2007-0125

Affected Products

Kaspersky Antivirus Engine

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-0125 · Security Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=459 · Vendor Advisory
• http://secunia.com/advisories/23575 · Vendor Advisory
• http://vupen.com/english/advisories/2007/0067 · Note
• http://securityfocus.com/bid/21901 · Note
• http://osvdb.org/32588 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31315 · Note
• http://securitytracker.com/id?1017476 · Note