F-Secure Products RPM File Handling Integer Overflow Vulnerability
Last Update Date:
28 Jan 2011
Release Date:
22 Oct 2008
4784
Views
RISK: Medium Risk
A vulnerability has been identified in various F-Secure products, which could be exploited by attackers or malware to compromise a vulnerable system. This issue is caused by an integer overflow error when processing malformed RPM files, which could be exploited to crash an affected application set to scan inside compressed archives or execute arbitrary code via a malicious file.
Impact
- Denial of Service
- Remote Code Execution
System / Technologies affected
- F-Secure Internet Security 2008
- F-Secure Internet Security 2007 Second Edition
- F-Secure Internet Security 2007
- F-Secure Internet Security 2006
- F-Secure Anti-Virus 2008
- F-Secure Anti-Virus 2007 Second Edition
- F-Secure Anti-Virus 2007
- F-Secure Anti-Virus 2006
- F-Secure Client Security 7.12 and prior
- F-Secure Anti-Virus for Workstations 7.11 and prior
- F-Secure Linux Security 7.01 and prior
- F-Secure Anti-Virus Linux Client Security 5.54 and prior
- Solutions based on F-Secure Protection Service for Consumers version 8.00 and prior
- Solutions based on F-Secure Protection Service for Business version 3.10 and prior
- F-Secure Home Server Security 2009
- F-Secure Anti-Virus for Windows Servers 8.00 and prior
- F-Secure Anti-Virus for Citrix Servers 7.00 and prior
- F-Secure Linux Security 7.01 and prior
- F-Secure Anti-Virus Linux Server Security 5.54 and prior
- F-Secure Anti-Virus for Linux Servers 4.65
- F-Secure Anti-Virus for Microsoft Exchange 7.10 and prior
- F-Secure Internet Gatekeeper for Windows 6.61 and prior
- F-Secure Internet Gatekeeper for Linux 2.16 and prior
- F-Secure Anti-Virus for Linux Gateways 4.65
- F-Secure Anti-Virus for MIMEsweeper 5.61 and prior
- F-Secure Messaging Security Gateway 5.0.4 and prior
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- Apply patches :
http://www.f-secure.com/security/fsc-2008-3.shtml
Vulnerability Identifier
- No CVE information is available
Source
Related Link
Share with