PT-2008-2993 · F Secure · F-Secure Internet Security+1

Published 2008-03-20 · Updated 2017-08-08 · CVE-2008-1412

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions F-Secure Internet Security versions 2006 through 2008 F-Secure Anti-Virus versions 2006 through 2008

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a malformed archive that triggers an unhandled exception. This can be demonstrated by the PROTOS GENOME test suite for Archive Formats.

Recommendations For F-Secure Internet Security versions 2006 through 2008, update to a version that is not affected by this issue. For F-Secure Anti-Virus versions 2006 through 2008, update to a version that is not affected by this issue. As a temporary workaround, consider restricting the handling of malformed archives to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-1412

Affected Products

F-Secure Anti-Virus

F-Secure Internet Security

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2008-1412 · Security Note
• http://f-secure.com/security/fsc-2008-2.shtml · Patch
• http://secunia.com/advisories/29397 · Vendor Advisory
• http://ee.oulu.fi/research/ouspg/protos/testing/c10/archive · Note
• http://securitytracker.com/id?1019620 · Note
• http://support.f-secure.com/enu/corporate/downloads/hotfixes/av-mimesweeper-hotfixes.shtml · Note
• http://securitytracker.com/id?1019618 · Note
• http://vupen.com/english/advisories/2008/0903/references · Note
• http://cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html · Note
• http://securityfocus.com/bid/28282 · Note
• http://securitytracker.com/id?1019619 · Note
• http://support.f-secure.com/enu/corporate/downloads/hotfixes/av-cs-hotfixes.shtml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41234 · Note