var-200710-0282
Vulnerability from variot
F-Secure Anti-Virus for Windows Servers 7.0 64-bit edition allows local users to bypass virus scanning by using the system32 directory to store a crafted (1) archive or (2) packed executable. NOTE: in many environments, this does not cross privilege boundaries because any process able to write to system32 could also shut off F-Secure Anti-Virus. F-Secure Anti-Virus for Windows Servers is prone to a vulnerability that may allow certain malware to bypass detection. An attacker may exploit this issue by placing maliciously crafted archives or packed executables in specific locations on a victim's computer. Successful exploits will allow attackers to place on the computer malicious code that the antivirus application will fail to detect. If this code is subsequently run, this may result in a malware infection. F-Secure Anti-Virus for Windows Servers 7.0 is affected by this issue.
Try a new way to discover vulnerabilities that ALREADY EXIST in your IT infrastructure.
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT vulnerabilities in more than 4,700 different Windows applications.
Request your account, the Secunia Network Software Inspector (NSI): http://secunia.com/network_software_inspector/
TITLE: F-Secure Archives and Packed Executables Detection Bypass
SECUNIA ADVISORY ID: SA26948
VERIFY ADVISORY: http://secunia.com/advisories/26948/
CRITICAL: Not critical
IMPACT: Security Bypass
WHERE:
From remote
SOFTWARE: F-Secure Anti-Virus for Windows Servers 7.x http://secunia.com/product/14382/
DESCRIPTION: A vulnerability has been reported in F-Secure Anti-Virus, which can be exploited by malware to bypass the scanning functionality.
The vulnerability only affects 64-bit server platforms.
SOLUTION: Apply patch. ftp://ftp.f-secure.com/support/hotfix/fsav/fsav720-01-signed.fsfix
PROVIDED AND/OR DISCOVERED BY: The vendor credits Mr Papadorotheoun.
ORIGINAL ADVISORY: http://www.f-secure.com/security/fsc-2007-6.shtml
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200710-0282",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "7.00"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 0.8,
"vendor": "f secure",
"version": "windows servers edition"
},
{
"model": "windows server 2003",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "7.0 64-bit edition"
},
{
"model": "windows 2003 server",
"scope": "eq",
"trust": 0.6,
"vendor": "microsoft",
"version": "x64"
},
{
"model": "anti-virus for windows servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "7.00"
}
],
"sources": [
{
"db": "BID",
"id": "25824"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002708"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-035"
},
{
"db": "NVD",
"id": "CVE-2007-5143"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:f-secure:anti-virus",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:microsoft:windows_server_2003",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002708"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mr Papadorotheoun is credited with discovering this issue.",
"sources": [
{
"db": "BID",
"id": "25824"
}
],
"trust": 0.3
},
"cve": "CVE-2007-5143",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.4,
"id": "CVE-2007-5143",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 1.9,
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.4,
"id": "VHN-28505",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2007-5143",
"trust": 1.0,
"value": "LOW"
},
{
"author": "NVD",
"id": "CVE-2007-5143",
"trust": 0.8,
"value": "Low"
},
{
"author": "CNNVD",
"id": "CNNVD-200710-035",
"trust": 0.6,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-28505",
"trust": 0.1,
"value": "LOW"
},
{
"author": "VULMON",
"id": "CVE-2007-5143",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28505"
},
{
"db": "VULMON",
"id": "CVE-2007-5143"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002708"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-035"
},
{
"db": "NVD",
"id": "CVE-2007-5143"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "F-Secure Anti-Virus for Windows Servers 7.0 64-bit edition allows local users to bypass virus scanning by using the system32 directory to store a crafted (1) archive or (2) packed executable. NOTE: in many environments, this does not cross privilege boundaries because any process able to write to system32 could also shut off F-Secure Anti-Virus. F-Secure Anti-Virus for Windows Servers is prone to a vulnerability that may allow certain malware to bypass detection. \nAn attacker may exploit this issue by placing maliciously crafted archives or packed executables in specific locations on a victim\u0027s computer. \nSuccessful exploits will allow attackers to place on the computer malicious code that the antivirus application will fail to detect. If this code is subsequently run, this may result in a malware infection. \nF-Secure Anti-Virus for Windows Servers 7.0 is affected by this issue. \n\n----------------------------------------------------------------------\n\nTry a new way to discover vulnerabilities that ALREADY EXIST in your\nIT infrastructure. \n\nThe Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT\nvulnerabilities in more than 4,700 different Windows applications. \n\nRequest your account, the Secunia Network Software Inspector (NSI):\nhttp://secunia.com/network_software_inspector/\n\n----------------------------------------------------------------------\n\nTITLE:\nF-Secure Archives and Packed Executables Detection Bypass\n\nSECUNIA ADVISORY ID:\nSA26948\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/26948/\n\nCRITICAL:\nNot critical\n\nIMPACT:\nSecurity Bypass\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nF-Secure Anti-Virus for Windows Servers 7.x\nhttp://secunia.com/product/14382/\n\nDESCRIPTION:\nA vulnerability has been reported in F-Secure Anti-Virus, which can\nbe exploited by malware to bypass the scanning functionality. \n\nThe vulnerability only affects 64-bit server platforms. \n\nSOLUTION:\nApply patch. \nftp://ftp.f-secure.com/support/hotfix/fsav/fsav720-01-signed.fsfix\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits Mr Papadorotheoun. \n\nORIGINAL ADVISORY:\nhttp://www.f-secure.com/security/fsc-2007-6.shtml\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-5143"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002708"
},
{
"db": "BID",
"id": "25824"
},
{
"db": "VULHUB",
"id": "VHN-28505"
},
{
"db": "VULMON",
"id": "CVE-2007-5143"
},
{
"db": "PACKETSTORM",
"id": "59636"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-5143",
"trust": 2.9
},
{
"db": "BID",
"id": "25824",
"trust": 2.1
},
{
"db": "SECUNIA",
"id": "26948",
"trust": 1.9
},
{
"db": "SECTRACK",
"id": "1018745",
"trust": 1.8
},
{
"db": "OSVDB",
"id": "41377",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2007-3277",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002708",
"trust": 0.8
},
{
"db": "XF",
"id": "36833",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200710-035",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-28505",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2007-5143",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "59636",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28505"
},
{
"db": "VULMON",
"id": "CVE-2007-5143"
},
{
"db": "BID",
"id": "25824"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002708"
},
{
"db": "PACKETSTORM",
"id": "59636"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-035"
},
{
"db": "NVD",
"id": "CVE-2007-5143"
}
]
},
"id": "VAR-200710-0282",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-28505"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:09:45.582000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security advisories",
"trust": 0.8,
"url": "http://www.f-secure.com/en/web/labs_global/security-advisories"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://windows.microsoft.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002708"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-DesignError",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002708"
},
{
"db": "NVD",
"id": "CVE-2007-5143"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "http://www.f-secure.com/security/fsc-2007-6.shtml"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/25824"
},
{
"trust": 1.8,
"url": "http://osvdb.org/41377"
},
{
"trust": 1.8,
"url": "http://www.securitytracker.com/id?1018745"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/26948"
},
{
"trust": 1.2,
"url": "http://www.vupen.com/english/advisories/2007/3277"
},
{
"trust": 1.2,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36833"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-5143"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-5143"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/36833"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2007/3277"
},
{
"trust": 0.3,
"url": "http://www.f-secure.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/network_software_inspector/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/14382/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/26948/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28505"
},
{
"db": "VULMON",
"id": "CVE-2007-5143"
},
{
"db": "BID",
"id": "25824"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002708"
},
{
"db": "PACKETSTORM",
"id": "59636"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-035"
},
{
"db": "NVD",
"id": "CVE-2007-5143"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-28505"
},
{
"db": "VULMON",
"id": "CVE-2007-5143"
},
{
"db": "BID",
"id": "25824"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002708"
},
{
"db": "PACKETSTORM",
"id": "59636"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-035"
},
{
"db": "NVD",
"id": "CVE-2007-5143"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-10-01T00:00:00",
"db": "VULHUB",
"id": "VHN-28505"
},
{
"date": "2007-10-01T00:00:00",
"db": "VULMON",
"id": "CVE-2007-5143"
},
{
"date": "2007-09-27T00:00:00",
"db": "BID",
"id": "25824"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002708"
},
{
"date": "2007-09-27T23:54:21",
"db": "PACKETSTORM",
"id": "59636"
},
{
"date": "2007-10-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200710-035"
},
{
"date": "2007-10-01T05:17:00",
"db": "NVD",
"id": "CVE-2007-5143"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-29T00:00:00",
"db": "VULHUB",
"id": "VHN-28505"
},
{
"date": "2017-07-29T00:00:00",
"db": "VULMON",
"id": "CVE-2007-5143"
},
{
"date": "2015-05-07T17:35:00",
"db": "BID",
"id": "25824"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002708"
},
{
"date": "2007-10-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200710-035"
},
{
"date": "2024-11-21T00:37:14.180000",
"db": "NVD",
"id": "CVE-2007-5143"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-035"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "F-Secure Anti-Virus Vulnerable to virus scanning",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002708"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "25824"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-035"
}
],
"trust": 0.9
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…