Sign-up

ID

VAR-200412-0351


CVE

CVE-2004-2442


TITLE

F-Secure Anti-Virus ZIP Archive Scanner Bypass Vulnerability

Trust: 0.9

sources: BID: 11732 // CNNVD: CNNVD-200412-1124

DESCRIPTION

Multiple interpretation error in various F-Secure Anti-Virus products, including Workstation 5.43 and earlier, Windows Servers 5.50 and earlier, MIMEsweeper 5.50 and earlier, Anti-Virus for Linux Servers and Gateways 4.61 and earlier, and other products, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on the target system. Anti-virus software may rely on corrupted headers to determine if a zip archive is valid. As a result, anti-virus software may fail to detect malicious content within a zip archive. It is reported that the software does not filter certain ZIP archives. Exploitation of this vulnerability may result in a false sense of security and in the execution of malicious applications. The vulnerability does not prevent compressed files from being opened on the target system. TITLE: F-Secure Products Zip Archive Virus Detection Bypass Vulnerability SECUNIA ADVISORY ID: SA13263 VERIFY ADVISORY: http://secunia.com/advisories/13263/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: >From remote SOFTWARE: F-Secure Internet Security 2005 http://secunia.com/product/4300/ F-Secure Internet Security 2004 http://secunia.com/product/3499/ F-Secure Internet Gatekeeper 6.x http://secunia.com/product/3339/ F-Secure Anti-Virus for Workstations 5.x http://secunia.com/product/457/ F-Secure Anti-Virus for Samba Servers 4.x http://secunia.com/product/3501/ F-Secure Anti-Virus for MIMEsweeper 5.x http://secunia.com/product/455/ F-Secure Anti-Virus for Microsoft Exchange 6.x http://secunia.com/product/454/ F-Secure Anti-Virus for Linux 4.x http://secunia.com/product/3165/ F-Secure Anti-Virus for Firewalls 6.x http://secunia.com/product/451/ F-Secure Anti-Virus Client Security 5.x http://secunia.com/product/2718/ F-Secure Anti-Virus 5.x http://secunia.com/product/3334/ F-Secure Anti-Virus 2005 http://secunia.com/product/4299/ F-Secure Anti-Virus 2004 http://secunia.com/product/3500/ DESCRIPTION: A vulnerability has been reported in various F-Secure products, which can be exploited by malware to bypass certain scanning functionality. The vulnerability is caused due to an error when parsing ".zip" archives and can be exploited via a specially crafted ".zip" archive, which the scanner incorrectly calculates be of zero length. Successful exploitation causes malware in a specially crafted ".zip" archive to bypass the scanning functionality. NOTE: This is not a critical issue on client systems, as the malware still is detected when it is extracted. PROVIDED AND/OR DISCOVERED BY: Reported by vendor. ORIGINAL ADVISORY: http://www.f-secure.com/security/fsc-2004-3.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2004-2442 // CERT/CC: VU#968818 // BID: 11732 // VULHUB: VHN-10870 // PACKETSTORM: 35148

AFFECTED PRODUCTS

vendor:f securemodel:f-secure anti-virusscope:eqversion:2004

Trust: 1.6

vendor:f securemodel:f-secure anti-virusscope:eqversion:4.52

Trust: 1.6

vendor:f securemodel:f-secure anti-virusscope:eqversion:4.51

Trust: 1.6

vendor:f securemodel:f-secure anti-virusscope:eqversion:2005

Trust: 1.6

vendor:f securemodel:f-secure anti-virusscope:eqversion:4.60

Trust: 1.6

vendor:f securemodel:f-secure anti-virusscope:eqversion:5.41

Trust: 1.6

vendor:f securemodel:f-secure for firewallsscope:eqversion:6.20

Trust: 1.3

vendor:f securemodel:internet gatekeeperscope:eqversion:6.41

Trust: 1.3

vendor:f securemodel:internet gatekeeperscope:eqversion:6.32

Trust: 1.3

vendor:f securemodel:internet gatekeeperscope:eqversion:6.31

Trust: 1.3

vendor:f securemodel:internet gatekeeperscope:eqversion:6.3

Trust: 1.3

vendor:f securemodel:f-secure personal expressscope:eqversion:4.6

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:6.31

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:4.61

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:5.55

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:6.30

Trust: 1.0

vendor:f securemodel:f-secure internet securityscope:eqversion:2005

Trust: 1.0

vendor:f securemodel:f-secure personal expressscope:eqversion:5.0

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:5.42

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:5.0

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:6.01

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:5.52

Trust: 1.0

vendor:f securemodel:f-secure internet securityscope:eqversion:2004

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:6.30_sr1

Trust: 1.0

vendor:f securemodel:internet gatekeeperscope:eqversion:6.4

Trust: 1.0

vendor:f securemodel:f-secure personal expressscope:eqversion:4.5

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:5.5

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:6.21

Trust: 1.0

vendor:f securemodel:internet gatekeeperscope:eqversion:2.6

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:5.43

Trust: 1.0

vendor:f securemodel:f-secure personal expressscope:eqversion:4.7

Trust: 1.0

vendor:f securemodel:f-secure anti-virusscope:eqversion:6.2

Trust: 1.0

vendor:f securemodel:internet gatekeeper for linuxscope:eqversion:2.6

Trust: 0.3

vendor:f securemodel:anti-virus client securityscope:eqversion:5.52

Trust: 0.3

vendor:f securemodel:anti-virus for ms exchangescope:eqversion:6.2

Trust: 0.3

vendor:f securemodel:anti-virus for workstationsscope:eqversion:5.43

Trust: 0.3

vendor:f securemodel:personal expressscope:eqversion:4.7

Trust: 0.3

vendor:f securemodel:anti-virusscope:eqversion:2005

Trust: 0.3

vendor:f securemodel:anti-virus for ms exchangescope:eqversion:6.21

Trust: 0.3

vendor:f securemodel:anti-virus for windows serversscope:eqversion:5.41

Trust: 0.3

vendor:f securemodel:anti-virus for linux gatewaysscope:eqversion:4.61

Trust: 0.3

vendor:f securemodel:anti-virus for windows serversscope:eqversion:5.42

Trust: 0.3

vendor:f securemodel:anti-virusscope:eqversion:2004

Trust: 0.3

vendor:f securemodel:anti-virus for linux serversscope:eqversion:4.61

Trust: 0.3

vendor:f securemodel:personal expressscope:eqversion:4.5

Trust: 0.3

vendor:f securemodel:anti-virus for ms exchangescope:eqversion:6.31

Trust: 0.3

vendor:f securemodel:anti-virus for samba serversscope:eqversion:4.60

Trust: 0.3

vendor:f securemodel:anti-virus for ms exchangescope:eqversion:6.01

Trust: 0.3

vendor:f securemodel:internet gatekeeperscope:eqversion:6.400

Trust: 0.3

vendor:f securemodel:personal expressscope:eqversion:5.0

Trust: 0.3

vendor:f securemodel:anti-virus for linux gatewaysscope:eqversion:4.52

Trust: 0.3

vendor:f securemodel:anti-virus for linux serversscope:eqversion:4.52

Trust: 0.3

vendor:f securemodel:anti-virus client securityscope:eqversion:5.55

Trust: 0.3

vendor:f securemodel:anti-virus for ms exchangescope:eqversion:6.30

Trust: 0.3

vendor:f securemodel:anti-virus linux client securityscope:eqversion:5.0

Trust: 0.3

vendor:f securemodel:anti-virus for ms exchange service releasescope:eqversion:6.301

Trust: 0.3

vendor:f securemodel:internet securityscope:eqversion:2005

Trust: 0.3

vendor:f securemodel:internet securityscope:eqversion:2004

Trust: 0.3

vendor:f securemodel:anti-virus for mimesweeperscope:eqversion:5.50

Trust: 0.3

vendor:f securemodel:anti-virus for linux gatewaysscope:eqversion:4.51

Trust: 0.3

vendor:f securemodel:anti-virus for linux workstationsscope:eqversion:4.52

Trust: 0.3

vendor:f securemodel:anti-virus for linux serversscope:eqversion:4.51

Trust: 0.3

vendor:f securemodel:anti-virus for linux workstationsscope:eqversion:4.51

Trust: 0.3

vendor:f securemodel:anti-virus for workstationsscope:eqversion:5.41

Trust: 0.3

vendor:f securemodel:personal expressscope:eqversion:4.6

Trust: 0.3

vendor:f securemodel:anti-virus for mimesweeperscope:eqversion:5.41

Trust: 0.3

vendor:f securemodel:anti-virus linux server securityscope:eqversion:5.0

Trust: 0.3

vendor:f securemodel:anti-virus for workstationsscope:eqversion:5.42

Trust: 0.3

vendor:f securemodel:anti-virus client securityscope:eqversion:5.50

Trust: 0.3

vendor:f securemodel:anti-virus for mimesweeperscope:eqversion:5.42

Trust: 0.3

vendor:f securemodel:anti-virus for windows serversscope:eqversion:5.50

Trust: 0.3

sources: BID: 11732 // CNNVD: CNNVD-200412-1124 // NVD: CVE-2004-2442

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2004-2442
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#968818
value: 7.59

Trust: 0.8

CNNVD: CNNVD-200412-1124
value: MEDIUM

Trust: 0.6

VULHUB: VHN-10870
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2004-2442
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-10870
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#968818 // VULHUB: VHN-10870 // CNNVD: CNNVD-200412-1124 // NVD: CVE-2004-2442

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2004-2442

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200412-1124

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200412-1124

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-10870

EXTERNAL IDS
db:CERT/CCid:VU#968818
Trust: 2.5
db:BIDid:11732
Trust: 2.0
db:SECUNIAid:13263
Trust: 1.8
db:NVDid:CVE-2004-2442
Trust: 1.7
db:CIACid:P-041
Trust: 0.6
db:XFid:18217
Trust: 0.6
db:CNNVDid:CNNVD-200412-1124
Trust: 0.6
db:EXPLOIT-DBid:629
Trust: 0.1
db:VULHUBid:VHN-10870
Trust: 0.1
db:PACKETSTORMid:35148
Trust: 0.1
sources:
            
            
            CERT/CC: VU#968818 // 
            
            
            
            VULHUB: VHN-10870 // 
            
            
            
            BID: 11732 // 
            
            
            
            PACKETSTORM: 35148 // 
            
            
            
            CNNVD: CNNVD-200412-1124 // 
            
            
            
            NVD: CVE-2004-2442

REFERENCES
url:http://www.f-secure.com/security/fsc-2004-3.shtml
Trust: 2.1
url:http://secunia.com/advisories/13263/
Trust: 1.8
url:http://www.securityfocus.com/bid/11732
Trust: 1.7
url:http://www.kb.cert.org/vuls/id/968818
Trust: 1.7
url:http://www.ciac.org/ciac/bulletins/p-041.shtml
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/18217
Trust: 1.1
url:http://www.linuxsecurity.com/advisories/gentoo_advisory-5043.html
Trust: 0.8
url:http://rt.cpan.org/noauth/bug.html?id=8077
Trust: 0.8
url:http://www.idefense.com/application/poi/display?id=153
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/18217
Trust: 0.6
url:http://secunia.com/product/457/
Trust: 0.1
url:http://secunia.com/product/454/
Trust: 0.1
url:http://secunia.com/product/3500/
Trust: 0.1
url:http://secunia.com/product/4300/
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/product/3334/
Trust: 0.1
url:http://secunia.com/product/3501/
Trust: 0.1
url:http://secunia.com/product/3339/
Trust: 0.1
url:http://secunia.com/product/3165/
Trust: 0.1
url:http://secunia.com/product/3499/
Trust: 0.1
url:http://secunia.com/product/451/
Trust: 0.1
url:http://secunia.com/product/455/
Trust: 0.1
url:http://secunia.com/product/2718/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/product/4299/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#968818 // 
            
            
            
            VULHUB: VHN-10870 // 
            
            
            
            BID: 11732 // 
            
            
            
            PACKETSTORM: 35148 // 
            
            
            
            CNNVD: CNNVD-200412-1124 // 
            
            
            
            NVD: CVE-2004-2442

CREDITS
F-Secure
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200412-1124

SOURCES
db:CERT/CCid:VU#968818
db:VULHUBid:VHN-10870
db:BIDid:11732
db:PACKETSTORMid:35148
db:CNNVDid:CNNVD-200412-1124
db:NVDid:CVE-2004-2442

LAST UPDATE DATE
2024-08-14T13:51:14.201000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#968818date:2005-01-14T00:00:00
db:VULHUBid:VHN-10870date:2017-07-11T00:00:00
db:BIDid:11732date:2004-11-23T00:00:00
db:CNNVDid:CNNVD-200412-1124date:2006-08-16T00:00:00
db:NVDid:CVE-2004-2442date:2017-07-11T01:31:54.030

SOURCES RELEASE DATE
db:CERT/CCid:VU#968818date:2004-12-10T00:00:00
db:VULHUBid:VHN-10870date:2004-12-31T00:00:00
db:BIDid:11732date:2004-11-23T00:00:00
db:PACKETSTORMid:35148date:2004-12-11T18:49:21
db:CNNVDid:CNNVD-200412-1124date:2004-12-31T00:00:00
db:NVDid:CVE-2004-2442date:2004-12-31T05:00:00