[NT] Sophos Anti-Virus XSS Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Sophos Anti-Virus XSS Vulnerability
------------------------------------------------------------------------

SUMMARY

A ZIP archive containing a virus signature with a malformed file name will
cause a Cross Site Scripting vulnerability to be triggered from within the
Sophos Anti Virus client.

DETAILS

Vulnerable Systems:
* Sophos Anti-Virus version 6.5.4 R2

Immune Systems:
* Sophos Anti-Virus version 6.5.8 or newer

When Sophos anti-virus scans a specially crafted ZIP archive containing a
XSS attack string, it will internally log the string. When this
information is accessed via the Sophos client (SavMain.exe) the XSS attack
string is unencoded. When the print function is called, the application
can be used to run arbitrary code on the target machine from an external
attacker's submitted file.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4512>
CVE-2007-4512

Disclosure Timeline
18 April 2007 - Initial Discovery and vendor notification
19 April 2007 - Vendor Response
21 August 2007 - Second Vendor Response
6 September 2007 - Coordinated Public Release

ADDITIONAL INFORMATION

The information has been provided by Context Information Security.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.