Check Point Advisories

McAfee Multiple Products LHA Type-2 File Handling Buffer Overflow (CVE-2005-0644)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-212
Date Published:	27 Dec 2009
Severity:	Critical
Last Updated:	Sunday 27 December, 2009
Source:
Industry Reference:	CVE-2005-0644
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	McAfee, formally Network Associates Incorporated, produces a number of popular anti-virus products for both Enterprise and Desktop consumer use. These products are capable of detecting malicious content not only within regular files but also within compressed archives such as LHA archives. There exists a vulnerability in the way McAfee Antivirus Library parses LHA Type-2 archive files. The vulnerable archive parser does not perform sufficient bounds checking on certain fields in the header of LHA archive files, resulting in a buffer overflow. An attacker can exploit this vulnerability to execute arbitrary code in the SYSTEM context on the target system by sending a specially crafted LHA file to the target. Upon receiving a simple attack, the thread of the vulnerable product will crash when it tries to scan the malicious LHA archive for known trojans or viruses, therefore an malicious LHA archive may be downloaded and stored on the local file system without the affected product raising a warning or otherwise informing the user of a potential threat. The product in such a case exhibits ineffective and misleading behavior. In an attack that allows code execution, the target system's behavior is entirely dependent on the intended purpose of the injected code. The code will execute with system privileges.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the McAfee Multiple Products LHA Type-2 File Handling Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Security Products Enforcement Violation.
Attack Information: McAfee Multiple Products LHA type-2 file handling buffer overflow