Check Point Advisories

Multiple Security Products LHA File Handling Buffer Overflow (CVE-2005-0643)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-211
Date Published:	4 Oct 2009
Severity:	Critical
Last Updated:	Sunday 04 October, 2009
Source:
Industry Reference:	CVE-2005-0643
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Several anti-virus products ,both for Enterprise and Desktop consumer use, are capable of detecting malicious content not only within regular files but also within compressed archives such as LHA archives. There exists a vulnerability in the way several anti-virus libraries parse LHA compressed files. The vulnerable archive parser does not perform sufficient bounds checking on the headers of LHA archive files, resulting in a buffer overflow. An attacker can exploit this vulnerability to execute arbitrary code in SYSTEM context on the target system by sending a specially crafted LHA file to the target. Upon receiving a simple attack, the thread of the vulnerable product will crash when it try to scan the malicious LHA archive for known trojans or viruses, therefore a malicious LHA archive may be downloaded and stored on the local file system without the affected product raising a warning or otherwise informing the user of a potential threat. The product in such a case exhibits ineffective and misleading behaviour. In an attack that allows code execution, the target system's behaviour is entirely dependent on the intended purpose of the injected code. The code will execute with system privileges.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Multiple Security Products LHA File Handling Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Security Products Enforcement Violation.
Attack Information: Multiple security products LHA file handling buffer overflow