Check Point Advisories

NOD32 Anti-Virus ARJ Archive Handling Buffer Overflow (CVE-2005-2903)

Vulnerability
Protection

Check Point Reference:	CPAI-2011-094
Date Published:	31 Mar 2011
Severity:	High
Last Updated:	Thursday 31 March, 2011
Source:
Industry Reference:	CVE-2005-2903
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	The Eset NOD32 anti-virus (AV) product line has the ability to decompress files in numerous archive formats for virus scanning. One such supported archive format is the ARJ format. A buffer overflow vulnerability has been reported in Eset's NOD32 Anti-Virus products. The flaw is triggered when scanning ARJ archives containing compressed files with overly long filenames. A remote attacker can exploit this issue by sending a specially crafted ARJ file to a target system. Successful exploitation of this vulnerability can allow the attacker to bypass virus scanning, or execute arbitrary code on the affected system and may result in a denial of service condition.

Protection Overview

This protection will detect and block the transferring of crafted ARJ files over HTTP.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the NOD32 Anti-Virus ARJ Archive Handling Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Security Products Enforcement Violation.
Attack Information: NOD32 Anti-Virus ARJ archive handling buffer overflow