Vulnerability Name:

CVE-2004-2405 (CCN-16258)

Assigned:2004-05-26
Published:2004-05-26
Updated:2017-07-11
Summary:Buffer overflow in multiple F-Secure Anti-Virus products, including F-Secure Anti-Virus 5.42 and earlier, allows remote attackers to bypass scanning or cause a denial of service (crash or module restart), depending on the product, via a malformed LHA archive.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2004-2405

Source: CCN
Type: SA11712
F-Secure Anti-Virus Products LHA Archive Processing Buffer Overflow

Source: SECUNIA
Type: Patch, Vendor Advisory
11712

Source: CCN
Type: F-Secure Security Bulletin FSC-2004-1
Buffer overflow caused by malformed LHA archive

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.f-secure.com/security/fsc-2004-1.shtml

Source: CCN
Type: OSVDB ID: 6423
F-Secure Anti-Virus Products LHA Archive Processing Overflow

Source: XF
Type: UNKNOWN
fsecure-lha-archive-bo(16258)

Source: XF
Type: UNKNOWN
fsecure-lha-archive-bo(16258)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:f-secure:f-secure_anti-virus:*:*:linux:*:*:*:*:* (Version <= 4.52)
  • OR cpe:/a:f-secure:f-secure_anti-virus:4.60:*:samba_servers:*:*:*:*:*
  • OR cpe:/a:f-secure:f-secure_anti-virus:*:*:mimesweeper:*:*:*:*:* (Version <= 5.42)
  • OR cpe:/a:f-secure:f-secure_anti-virus:*:*:windows_servers:*:*:*:*:* (Version <= 5.42)
  • OR cpe:/a:f-secure:f-secure_anti-virus:*:*:workstations:*:*:*:*:* (Version <= 5.42)
  • OR cpe:/a:f-secure:f-secure_anti-virus:*:*:client_security:*:*:*:*:* (Version <= 5.52)
  • OR cpe:/a:f-secure:f-secure_anti-virus:*:*:ms_exchange:*:*:*:*:* (Version <= 6.21)
  • OR cpe:/a:f-secure:f-secure_anti-virus:*:*:*:*:*:*:*:* (Version <= 2004)
  • OR cpe:/a:f-secure:f-secure_for_firewalls:*:*:*:*:*:*:*:* (Version <= 6.20)
  • OR cpe:/a:f-secure:f-secure_internet_security:*:*:*:*:*:*:*:* (Version <= 2004)
  • OR cpe:/a:f-secure:internet_gatekeeper:*:*:*:*:*:*:*:* (Version <= 6.32)

    • Configuration CCN 1:
  • cpe:/a:f-secure:f-secure_anti-virus:4.52::linux:*:*:*:*:*
  • OR cpe:/a:f-secure:internet_gatekeeper:6.32:*:*:*:*:*:*:*
  • OR cpe:/a:f-secure:f-secure_anti-virus:4.60::samba_servers:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    f-secure f-secure anti-virus *
    f-secure f-secure anti-virus 4.60
    f-secure f-secure anti-virus *
    f-secure f-secure anti-virus *
    f-secure f-secure anti-virus *
    f-secure f-secure anti-virus *
    f-secure f-secure anti-virus *
    f-secure f-secure anti-virus *
    f-secure f-secure for firewalls *
    f-secure f-secure internet security *
    f-secure internet gatekeeper *
    f-secure f-secure anti-virus 4.52
    f-secure internet gatekeeper 6.32
    f-secure f-secure anti-virus 4.60