Vulnerability CVE-2006-0338 - CERT Civis.Net

Vulnerability Name:

CVE-2006-0338 (CCN-24199)

Assigned:

2006-01-19

Published:

2006-01-19

Updated:

2017-07-20

Summary:

Multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti-Virus for Linux Servers 4.64 and earlier, allow remote attackers to hide arbitrary files and data via malformed (1) RAR and (2) ZIP archives, which are not properly scanned.

CVSS v3 Severity:

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2006-0338

Source: CCN
Type: SA18529
F-Secure Anti-Virus Archive Handling Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
18529

Source: CCN
Type: SECTRACK ID: 1015507
F-Secure Anti-Virus Buffer Overflow in Processing ZIP Archives Lets Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1015507

Source: CCN
Type: SECTRACK ID: 1015508
F-Secure Internet Gatekeeper Buffer Overflow in Processing ZIP Archives Lets Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1015508

Source: CCN
Type: SECTRACK ID: 1015509
F-Secure Personal Express Overflow in Processing ZIP Archives Lets Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1015509

Source: CCN
Type: SECTRACK ID: 1015510
F-Secure Internet Security Buffer Overflow in Processing ZIP Archives Lets Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1015510

Source: CIAC
Type: UNKNOWN
Q-103

Source: CCN
Type: F-Secure Security Bulletin FSC-2006-1
Code execution vulnerability in ZIP and RAR-archive handling

Source: CONFIRM
Type: Patch
http://www.f-secure.com/security/fsc-2006-1.shtml

Source: OSVDB
Type: UNKNOWN
22633

Source: CCN
Type: OSVDB ID: 22633
F-Secure Anti-Virus Crafted ZIP/RAR Scanner Bypass

Source: BID
Type: Patch
16309

Source: CCN
Type: BID-16309
F-Secure Multiple Archive Handling Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2006-0257

Source: XF
Type: UNKNOWN
fsecure-rar-zip-scan-bypass(24199)

Source: XF
Type: UNKNOWN
fsecure-rar-zip-scan-bypass(24199)

Vulnerable Configuration:

Configuration 1:

cpe:/a:f-secure:f-secure_anti-virus:4.51:*:linux_gateways:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.51:*:linux_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.52:*:linux_gateways:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.52:*:linux_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.52:*:linux_workstations:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.60:*:samba_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.61:*:linux_gateways:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.61:*:linux_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.62:*:samba_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.64:*:linux_gateways:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.64:*:linux_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.0:*:linux_client_security:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.0:*:linux_server_security:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.5:*:client_security:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.5:*:mimesweeper:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.5:*:windows_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.11:*:linux_client_security:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.11:*:linux_server_security:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.41:*:mimesweeper:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.41:*:workstations:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.42:*:mimesweeper:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.42:*:windows_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.42:*:workstations:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.43:*:workstations:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.44:*:workstations:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.52:*:citrix_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.52:*:client_security:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.52:*:mimesweeper:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.52:*:windows_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.55:*:client_security:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:6.01:*:client_security:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:6.01:*:ms_exchange:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:6.2:*:firewalls:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:6.2:*:ms_exchange:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:6.21:*:ms_exchange:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:6.30:*:ms_exchange:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:6.30_sr1:*:ms_exchange:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:6.31:*:ms_exchange:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:6.40:*:ms_exchange:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:2003:*:*:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:2004:*:*:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:2005:*:*:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_internet_security:2004:*:*:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_internet_security:2005:*:*:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_internet_security:2006:*:*:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_personal_express:4.5:*:*:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_personal_express:4.6:*:*:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_personal_express:4.7:*:*:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_personal_express:5.0:*:*:*:*:*:*:*

OR cpe:/a:f-secure:internet_gatekeeper:2.06:*:linux:*:*:*:*:*

OR cpe:/a:f-secure:internet_gatekeeper:2.14:*:linux:*:*:*:*:*

OR cpe:/a:f-secure:internet_gatekeeper:6.32:*:*:*:*:*:*:*

OR cpe:/a:f-secure:internet_gatekeeper:6.41:*:*:*:*:*:*:*

OR cpe:/a:f-secure:internet_gatekeeper:6.42:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:f-secure:internet_gatekeeper:6.42:*:*:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.52::windows_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:5.52::citrix_servers:*:*:*:*:*

OR cpe:/a:f-secure:f-secure_anti-virus:4.62::samba_servers:*:*:*:*:*

OR cpe:/a:f-secure:internet_gatekeeper:2.14::linux:*:*:*:*:*

Denotes that component is vulnerable