Description
Sophos Anti-Virus for Windows and for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UPX packed file, resulting from an "integer cast around". NOTE: as of 20070828, the vendor says this is a DoS and the researcher says this allows code execution, but the researcher is reliable.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.vupen.com/english/advisories/2007/2972 ↗
- http://www.nruns.com/security_advisory_sophos_upx_infinite_loop_dos.php ↗
- http://www.securityfocus.com/bid/25428 ↗
- http://secunia.com/advisories/26580 ↗
- http://www.securityfocus.com/archive/1/477864/100/0/threaded ↗
- http://www.sophos.com/support/knowledgebase/article/28407.html ↗
- http://securityreason.com/securityalert/3072 ↗
- http://www.securityfocus.com/archive/1/477882/100/0/threaded ↗
- http://www.securityfocus.com/archive/1/477720/100/0/threaded ↗
- http://securitytracker.com/id?1018608 ↗