[UNIX] Sophos Anti-Virus Zip DoS Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Sophos Anti-Virus Zip DoS Vulnerability
------------------------------------------------------------------------

SUMMARY

" <http://www.sophos.com> Sophos Small Business Suite is the best possible
defence against viruses, spam and malicious spyware."

Remote exploitation of a denial of service vulnerability in Sophos Plc.'s
Sophos Anti-Virus engine allows attackers to exhaust CPU resources on the
target system and prevent further scans.

DETAILS

Vulnerable Systems:
* Sophos Anti-Virus version 5.0.1
* Sophos Anti-Virus version 3.91
* Sophos Anti-Virus version 3.90

The problem specifically exists in the handling of Zip files compressed
using the BZIP2 algorithm. When scanning within a BZIP2 archive the Sophos
engine will not perform any sanity checks on the 'Extra field length'
value. By specifying an abnormally large value for this field the analysis
routine is forced into an infinite loop leading to CPU exhaustion. The
following is a hex dump of an example file that will trigger the issue:

00 50 4b 03 04 0a 00 00 00 0c 00 5c 84 67 32 5b 26 |PK........\.g2[&|
10 b9 09 01 00 00 00 01 00 00 00 03 00 ff ff 66 6f |..............fo|
20 6f 55 54 09 00 03 a0 74 2c 42 a1 74 2c 42 55 78 |oUT....t,B.t,BUx|
30 04 00 e8 03 e8 03 2a 50 4b 01 02 17 03 0a 00 00 |......*PK.......|
40 00 00 00 5c 84 67 32 5b 26 b9 09 01 00 00 00 01 |...\.g2[&.......|
50 00 00 00 03 00 0d 00 00 00 00 00 01 00 00 00 a4 |................|
60 81 00 00 00 00 66 6f 6f 55 54 05 00 03 a0 74 2c |.....fooUT....t,|
70 42 55 78 00 00 50 4b 05 06 00 00 00 00 01 00 01 |BUx..PK.........|
80 00 3e 00 00 00 37 00 00 00 00 00 |.>...7.....|

Bytes 08-09: Compression method - 0x000c == BZIP2 algorithm Bytes 28-29:
Extra field length - 0xffff . The function BZ2_decompress(), among others,
is called within the infinite loop.

Successful exploitation allows remote attackers to trigger a denial of
service condition on the target system. Remote exploitation can be
achieved by sending a malicious file in an e-mail message or during an
HTTP session. Exploitation is only possible if the 'Scan inside archive
files' option is enabled. This is not a default option but is a common
setting. Both Unix and Windows systems running a vulnerable version of
Sophos Anti-Virus are affected.

Workaround:
Disable the "Scan inside archive files" option.

Vendor Response:
"We have now included protection against this vulnerability into the
latest versions of Sophos Anti-Virus on Windows, UNIX, Linux, Netware,
OpenVMS and Mac OSX (version 3.95.0 on all those platforms as well as
version 5.0.4 on Windows 2000/XP/2003 and versions 4.5.3 on Windows NT and
Windows 95/98/Me) as well as into the latest updated versions of
PureMessage for UNIX, PureMessage for Windows/Exchange and MailMonitor
(any version running anti-virus engine 2.30.4 or above).

All of these versions would be updated automatically to customers using
our automatic updating through EM Library or direct from Sophos.
They are also available to customers to download at
<http://www.sophos.com/support/updates>
http://www.sophos.com/support/updates".

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1530>
CAN-2005-1530

Disclosure Timeline:
05/12/2005 - Initial vendor notification
05/16/2005 - Initial vendor response
07/14/2005 - Public disclosure

ADDITIONAL INFORMATION

The information has been provided by iDEFENSE Labs.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=283&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=283&type=vulnerabilities

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.