Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Archive_zip | Archive_zip | 1.13 (including) | 1.13 (including) |
| Brightstor_arcserve_backup | Broadcom | 11.1 (including) | 11.1 (including) |
| Etrust_antivirus | Broadcom | 7.0 (including) | 7.0 (including) |
| Etrust_antivirus | Broadcom | 7.1 (including) | 7.1 (including) |
| Etrust_antivirus_gateway | Broadcom | 7.0 (including) | 7.0 (including) |
| Etrust_antivirus_gateway | Broadcom | 7.1 (including) | 7.1 (including) |
| Etrust_ez_antivirus | Broadcom | 6.1 (including) | 6.1 (including) |
| Etrust_ez_antivirus | Broadcom | 6.2 (including) | 6.2 (including) |
| Etrust_ez_antivirus | Broadcom | 6.3 (including) | 6.3 (including) |
| Etrust_ez_armor | Broadcom | 2.0 (including) | 2.0 (including) |
| Etrust_ez_armor | Broadcom | 2.3 (including) | 2.3 (including) |
| Etrust_ez_armor | Broadcom | 2.4 (including) | 2.4 (including) |
| Etrust_intrusion_detection | Broadcom | 1.4.1.13 (including) | 1.4.1.13 (including) |
| Etrust_intrusion_detection | Broadcom | 1.4.5 (including) | 1.4.5 (including) |
| Etrust_intrusion_detection | Broadcom | 1.5 (including) | 1.5 (including) |
| Etrust_secure_content_manager | Broadcom | 1.0 (including) | 1.0 (including) |
| Etrust_secure_content_manager | Broadcom | 1.1 (including) | 1.1 (including) |
| Inoculateit | Broadcom | 6.0 (including) | 6.0 (including) |
| Etrust_antivirus | Ca | 7.0_sp2 (including) | 7.0_sp2 (including) |
| Etrust_secure_content_manager | Ca | 1.0-sp1 (including) | 1.0-sp1 (including) |
| Nod32_antivirus | Eset_software | 1.0.11 (including) | 1.0.11 (including) |
| Nod32_antivirus | Eset_software | 1.0.12 (including) | 1.0.12 (including) |
| Nod32_antivirus | Eset_software | 1.0.13 (including) | 1.0.13 (including) |
| Kaspersky_anti-virus | Kaspersky_lab | 3.0 (including) | 3.0 (including) |
| Kaspersky_anti-virus | Kaspersky_lab | 4.0 (including) | 4.0 (including) |
| Kaspersky_anti-virus | Kaspersky_lab | 5.0 (including) | 5.0 (including) |
| Antivirus_engine | Mcafee | 4.3.20 (including) | 4.3.20 (including) |
| Rav_antivirus_desktop | Rav_antivirus | 8.6 (including) | 8.6 (including) |
| Rav_antivirus_for_file_servers | Rav_antivirus | 1.0 (including) | 1.0 (including) |
| Rav_antivirus_for_mail_servers | Rav_antivirus | 8.4.2 (including) | 8.4.2 (including) |
| Sophos_anti-virus | Sophos | 3.4.6 (including) | 3.4.6 (including) |
| Sophos_anti-virus | Sophos | 3.78 (including) | 3.78 (including) |
| Sophos_anti-virus | Sophos | 3.78d (including) | 3.78d (including) |
| Sophos_anti-virus | Sophos | 3.79 (including) | 3.79 (including) |
| Sophos_anti-virus | Sophos | 3.80 (including) | 3.80 (including) |
| Sophos_anti-virus | Sophos | 3.81 (including) | 3.81 (including) |
| Sophos_anti-virus | Sophos | 3.82 (including) | 3.82 (including) |
| Sophos_anti-virus | Sophos | 3.83 (including) | 3.83 (including) |
| Sophos_anti-virus | Sophos | 3.84 (including) | 3.84 (including) |
| Sophos_anti-virus | Sophos | 3.85 (including) | 3.85 (including) |
| Sophos_anti-virus | Sophos | 3.86 (including) | 3.86 (including) |
| Sophos_puremessage_anti-virus | Sophos | 4.6 (including) | 4.6 (including) |
| Sophos_small_business_suite | Sophos | 1.0 (including) | 1.0 (including) |
References
- http://www.idefense.com/application/poi/display?id=153\u0026type=vulnerabilities\u0026flashstatus=true
- http://www.kb.cert.org/vuls/id/968818
- http://www.securityfocus.com/bid/11448
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17761
- http://www.idefense.com/application/poi/display?id=153\u0026type=vulnerabilities\u0026flashstatus=true
- http://www.kb.cert.org/vuls/id/968818
- http://www.securityfocus.com/bid/11448
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17761