PT-2007-4150 · Avast · Avast! Anti-Virus Managed Client

Published 2007-05-24 · Updated 2018-10-16 · CVE-2007-2846

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions avast! Anti-Virus Managed Client versions prior to 4.7.700

Description The issue is related to a heap-based buffer overflow in the SIS unpacker, which can be exploited by user-assisted remote attackers. This is caused by an "integer cast around" and can be triggered via a crafted SIS archive, potentially allowing the execution of arbitrary code.

Recommendations For versions prior to 4.7.700, update to version 4.7.700 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-2846

Affected Products

Avast! Anti-Virus Managed Client

References · 10

• http://vupen.com/english/advisories/2007/1935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2846 · Security Note
• http://nruns.com/advisories/%5Bn.runs-SA-2007.009%5D%20-%20Avast%21%20Antivirus%20SIS%20parsing%20Arbitrary%20Code%20Execution%20Advisory.txt · Note
• http://securityfocus.com/bid/24155 · Note
• http://securityfocus.com/archive/1/469585/100/0/threaded · Note
• http://marc.info/?l=full-disclosure&m=118007660813710&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34501 · Note
• http://kb.cert.org/vuls/id/125868 · Note
• http://osvdb.org/36522 · Note
• http://avast.com/eng/adnm-management-client-revision-history.html · Note