var-200511-0109
Vulnerability from variot

Heap-based buffer overflow in Kaspersky Anti-Virus Engine, as used in Kaspersky Personal 5.0.227, Anti-Virus On-Demand Scanner for Linux 5.0.5, and F-Secure Anti-Virus for Linux 4.50 allows remote attackers to execute arbitrary code via a crafted CHM file. On Microsoft platforms, the affected software cannot execute arbitrary code, but prevents Kaspersky Anti-Virus from scanning any files, thus potentially allowing later malicious code to reach its target.

For more information: SA17130

The vulnerability has been reported in version 4.50. Prior versions may also be affected.

TITLE: Kaspersky Anti-Virus Engine CHM File Parsing Buffer Overflow

SECUNIA ADVISORY ID: SA17130

VERIFY ADVISORY: http://secunia.com/advisories/17130/

CRITICAL: Highly critical

IMPACT: DoS, System access

WHERE:

From remote

SOFTWARE: Kaspersky Anti-Virus 5.x http://secunia.com/product/2781/

DESCRIPTION: A vulnerability has been reported in Kaspersky Anti-Virus, which can be exploited by malicious people to cause a DoS (Denial of Service), or compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the scan engine when parsing a malformed CHM file. This can be exploited to cause a heap-based buffer overflow when a specially crafted CHM file is scanned. On Windows platforms, the anti-virus may fail to scan any other files after a malformed CHM file has been encountered.

SOLUTION: The vulnerability has reportedly been fixed via a signature update after July 2005.

PROVIDED AND/OR DISCOVERED BY: Discovered by anonymous person and reported via iDEFENSE.

ORIGINAL ADVISORY: iDEFENSE: http://www.idefense.com/application/poi/display?id=318&type=vulnerabilities

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200511-0109",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "anti-virus personal",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "kaspersky lab",
        "version": "5.0.227"
      },
      {
        "model": "anti-virus",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "kaspersky lab",
        "version": "5.0.5"
      },
      {
        "model": "f-secure anti-virus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f secure",
        "version": "4.50"
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3664"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "iDEFENSE",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2005-3664",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2005-3664",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-14872",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2005-3664",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200511-258",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-14872",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-14872"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3664"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Heap-based buffer overflow in Kaspersky Anti-Virus Engine, as used in Kaspersky Personal 5.0.227, Anti-Virus On-Demand Scanner for Linux 5.0.5, and F-Secure Anti-Virus for Linux 4.50 allows remote attackers to execute arbitrary code via a crafted CHM file. On Microsoft platforms, the affected software cannot execute arbitrary code, but prevents Kaspersky Anti-Virus from scanning any files, thus potentially allowing later malicious code to reach its target. \n\nFor more information:\nSA17130\n\nThe vulnerability has been reported in version 4.50. Prior versions\nmay also be affected. \n\nTITLE:\nKaspersky Anti-Virus Engine CHM File Parsing Buffer Overflow\n\nSECUNIA ADVISORY ID:\nSA17130\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/17130/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nDoS, System access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nKaspersky Anti-Virus 5.x\nhttp://secunia.com/product/2781/\n\nDESCRIPTION:\nA vulnerability has been reported in Kaspersky Anti-Virus, which can\nbe exploited by malicious people to cause a DoS (Denial of Service),\nor compromise a vulnerable system. \n\nThe vulnerability is caused due to a boundary error in the scan\nengine when parsing a malformed CHM file. This can be exploited to\ncause a heap-based buffer overflow when a specially crafted CHM file\nis scanned. On Windows platforms, the anti-virus may fail to scan any\nother files after a malformed CHM file has been encountered. \n\nSOLUTION:\nThe vulnerability has reportedly been fixed via a signature update\nafter July 2005. \n\nPROVIDED AND/OR DISCOVERED BY:\nDiscovered by anonymous person and reported via iDEFENSE. \n\nORIGINAL ADVISORY:\niDEFENSE:\nhttp://www.idefense.com/application/poi/display?id=318\u0026type=vulnerabilities\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-3664"
      },
      {
        "db": "VULHUB",
        "id": "VHN-14872"
      },
      {
        "db": "PACKETSTORM",
        "id": "40601"
      },
      {
        "db": "PACKETSTORM",
        "id": "40600"
      }
    ],
    "trust": 1.17
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "SECUNIA",
        "id": "17130",
        "trust": 1.8
      },
      {
        "db": "SECUNIA",
        "id": "17144",
        "trust": 1.8
      },
      {
        "db": "OSVDB",
        "id": "19912",
        "trust": 1.7
      },
      {
        "db": "OSVDB",
        "id": "19913",
        "trust": 1.7
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3664",
        "trust": 1.7
      },
      {
        "db": "BID",
        "id": "15054",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-258",
        "trust": 0.7
      },
      {
        "db": "IDEFENSE",
        "id": "20051010 KASPERSKY ANTI-VIRUS ENGINE CHM FILE PARSER BUFFER OVERFLOW VULNERABILITY",
        "trust": 0.6
      },
      {
        "db": "XF",
        "id": "22564",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-14872",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "40601",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "40600",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-14872"
      },
      {
        "db": "PACKETSTORM",
        "id": "40601"
      },
      {
        "db": "PACKETSTORM",
        "id": "40600"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3664"
      }
    ]
  },
  "id": "VAR-200511-0109",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-14872"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T20:53:29.537000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-3664"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "http://www.idefense.com/application/poi/display?id=318\u0026type=vulnerabilities"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/15054"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/19912"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/19913"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/17130"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/17144"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22564"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/22564"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/advisories/17130/"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://www.idefense.com/application/poi/display?id=318\u0026amp;type=vulnerabilities"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/3165/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/17144/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/2781/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-14872"
      },
      {
        "db": "PACKETSTORM",
        "id": "40601"
      },
      {
        "db": "PACKETSTORM",
        "id": "40600"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3664"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-14872"
      },
      {
        "db": "PACKETSTORM",
        "id": "40601"
      },
      {
        "db": "PACKETSTORM",
        "id": "40600"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3664"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2005-11-18T00:00:00",
        "db": "VULHUB",
        "id": "VHN-14872"
      },
      {
        "date": "2005-10-11T23:51:24",
        "db": "PACKETSTORM",
        "id": "40601"
      },
      {
        "date": "2005-10-11T23:51:24",
        "db": "PACKETSTORM",
        "id": "40600"
      },
      {
        "date": "2005-10-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      },
      {
        "date": "2005-11-18T06:04:00",
        "db": "NVD",
        "id": "CVE-2005-3664"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-07-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-14872"
      },
      {
        "date": "2006-03-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      },
      {
        "date": "2024-11-21T00:02:23.080000",
        "db": "NVD",
        "id": "CVE-2005-3664"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Kaspersky Antivirus engine CHM File parser remote overflow vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer overflow",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-258"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.