VAR-200511-0109
Vulnerability from variot - Updated: 2023-12-18 11:14Heap-based buffer overflow in Kaspersky Anti-Virus Engine, as used in Kaspersky Personal 5.0.227, Anti-Virus On-Demand Scanner for Linux 5.0.5, and F-Secure Anti-Virus for Linux 4.50 allows remote attackers to execute arbitrary code via a crafted CHM file. On Microsoft platforms, the affected software cannot execute arbitrary code, but prevents Kaspersky Anti-Virus from scanning any files, thus potentially allowing later malicious code to reach its target.
For more information: SA17130
The vulnerability has been reported in version 4.50. Prior versions may also be affected.
TITLE: Kaspersky Anti-Virus Engine CHM File Parsing Buffer Overflow
SECUNIA ADVISORY ID: SA17130
VERIFY ADVISORY: http://secunia.com/advisories/17130/
CRITICAL: Highly critical
IMPACT: DoS, System access
WHERE:
From remote
SOFTWARE: Kaspersky Anti-Virus 5.x http://secunia.com/product/2781/
DESCRIPTION: A vulnerability has been reported in Kaspersky Anti-Virus, which can be exploited by malicious people to cause a DoS (Denial of Service), or compromise a vulnerable system.
The vulnerability is caused due to a boundary error in the scan engine when parsing a malformed CHM file. This can be exploited to cause a heap-based buffer overflow when a specially crafted CHM file is scanned. On Windows platforms, the anti-virus may fail to scan any other files after a malformed CHM file has been encountered.
SOLUTION: The vulnerability has reportedly been fixed via a signature update after July 2005.
PROVIDED AND/OR DISCOVERED BY: Discovered by anonymous person and reported via iDEFENSE.
ORIGINAL ADVISORY: iDEFENSE: http://www.idefense.com/application/poi/display?id=318&type=vulnerabilities
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200511-0109",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "anti-virus personal",
"scope": "eq",
"trust": 1.6,
"vendor": "kaspersky lab",
"version": "5.0.227"
},
{
"model": "anti-virus",
"scope": "eq",
"trust": 1.6,
"vendor": "kaspersky lab",
"version": "5.0.5"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.50"
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-3664"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.50:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:5.0.5:*:linux_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:5.0.5:*:linux_workstations:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0.227:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-3664"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "iDEFENSE",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
],
"trust": 0.6
},
"cve": "CVE-2005-3664",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": true,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-14872",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2005-3664",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200511-258",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-14872",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-14872"
},
{
"db": "NVD",
"id": "CVE-2005-3664"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in Kaspersky Anti-Virus Engine, as used in Kaspersky Personal 5.0.227, Anti-Virus On-Demand Scanner for Linux 5.0.5, and F-Secure Anti-Virus for Linux 4.50 allows remote attackers to execute arbitrary code via a crafted CHM file. On Microsoft platforms, the affected software cannot execute arbitrary code, but prevents Kaspersky Anti-Virus from scanning any files, thus potentially allowing later malicious code to reach its target. \n\nFor more information:\nSA17130\n\nThe vulnerability has been reported in version 4.50. Prior versions\nmay also be affected. \n\nTITLE:\nKaspersky Anti-Virus Engine CHM File Parsing Buffer Overflow\n\nSECUNIA ADVISORY ID:\nSA17130\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/17130/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nDoS, System access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nKaspersky Anti-Virus 5.x\nhttp://secunia.com/product/2781/\n\nDESCRIPTION:\nA vulnerability has been reported in Kaspersky Anti-Virus, which can\nbe exploited by malicious people to cause a DoS (Denial of Service),\nor compromise a vulnerable system. \n\nThe vulnerability is caused due to a boundary error in the scan\nengine when parsing a malformed CHM file. This can be exploited to\ncause a heap-based buffer overflow when a specially crafted CHM file\nis scanned. On Windows platforms, the anti-virus may fail to scan any\nother files after a malformed CHM file has been encountered. \n\nSOLUTION:\nThe vulnerability has reportedly been fixed via a signature update\nafter July 2005. \n\nPROVIDED AND/OR DISCOVERED BY:\nDiscovered by anonymous person and reported via iDEFENSE. \n\nORIGINAL ADVISORY:\niDEFENSE:\nhttp://www.idefense.com/application/poi/display?id=318\u0026type=vulnerabilities\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2005-3664"
},
{
"db": "VULHUB",
"id": "VHN-14872"
},
{
"db": "PACKETSTORM",
"id": "40601"
},
{
"db": "PACKETSTORM",
"id": "40600"
}
],
"trust": 1.17
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "SECUNIA",
"id": "17130",
"trust": 1.8
},
{
"db": "SECUNIA",
"id": "17144",
"trust": 1.8
},
{
"db": "OSVDB",
"id": "19912",
"trust": 1.7
},
{
"db": "OSVDB",
"id": "19913",
"trust": 1.7
},
{
"db": "NVD",
"id": "CVE-2005-3664",
"trust": 1.7
},
{
"db": "BID",
"id": "15054",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200511-258",
"trust": 0.7
},
{
"db": "IDEFENSE",
"id": "20051010 KASPERSKY ANTI-VIRUS ENGINE CHM FILE PARSER BUFFER OVERFLOW VULNERABILITY",
"trust": 0.6
},
{
"db": "XF",
"id": "22564",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-14872",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "40601",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "40600",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-14872"
},
{
"db": "PACKETSTORM",
"id": "40601"
},
{
"db": "PACKETSTORM",
"id": "40600"
},
{
"db": "NVD",
"id": "CVE-2005-3664"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
]
},
"id": "VAR-200511-0109",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-14872"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:14:14.344000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-3664"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "http://www.idefense.com/application/poi/display?id=318\u0026type=vulnerabilities"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/15054"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/19912"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/19913"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/17130"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/17144"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22564"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/22564"
},
{
"trust": 0.2,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/17130/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.idefense.com/application/poi/display?id=318\u0026amp;type=vulnerabilities"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/3165/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/17144/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/2781/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-14872"
},
{
"db": "PACKETSTORM",
"id": "40601"
},
{
"db": "PACKETSTORM",
"id": "40600"
},
{
"db": "NVD",
"id": "CVE-2005-3664"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-14872"
},
{
"db": "PACKETSTORM",
"id": "40601"
},
{
"db": "PACKETSTORM",
"id": "40600"
},
{
"db": "NVD",
"id": "CVE-2005-3664"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2005-11-18T00:00:00",
"db": "VULHUB",
"id": "VHN-14872"
},
{
"date": "2005-10-11T23:51:24",
"db": "PACKETSTORM",
"id": "40601"
},
{
"date": "2005-10-11T23:51:24",
"db": "PACKETSTORM",
"id": "40600"
},
{
"date": "2005-11-18T06:04:00",
"db": "NVD",
"id": "CVE-2005-3664"
},
{
"date": "2005-10-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-11T00:00:00",
"db": "VULHUB",
"id": "VHN-14872"
},
{
"date": "2017-07-11T01:33:16.503000",
"db": "NVD",
"id": "CVE-2005-3664"
},
{
"date": "2006-03-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaspersky Antivirus engine CHM File parser remote overflow vulnerability",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200511-258"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…