Multiple unspecified vulnerabilities in the scanning engine before 4.4.4 in F-Prot Antivirus before 6.0.9.0 allow remote attackers to cause a denial of service via (1) a crafted UPX-compressed file, which triggers an engine crash; (2) a crafted Microsoft Office file, which triggers an infinite loop; or (3) an ASPack-compressed file, which triggers an engine crash.

The remote host is affected by the vulnerability described in GLSA-200904-14 (F-PROT Antivirus: Multiple Denial of Service vulnerabilities)

    The following vulnerabilities were found:
    Multiple errors when processing UPX, ASPack or Microsoft Office     files (CVE-2008-3243).
    Infinite Sergio Alvarez of n.runs AG reported an invalid memory     access when processing a CHM file with a large nb_dir value     (CVE-2008-3244).
    Jonathan Brossard from iViZ Techno Solutions reported that F-PROT     Antivirus does not correctly process ELF binaries with corrupted     headers (CVE-2008-5747).
  Impact :

    A remote attacker could entice a user or automated system to scan a     specially crafted file, leading to a crash or infinite loop.
  Workaround :

    There is no known workaround at this time.

The version of F-PROT Anti-Virus installed on the remote Windows host contains flaws in the way it handles CHM, UPX-compressed, ASPack-compressed and certain Microsoft office files.

- A malformed CHM file containing '0xffffffff' in the     'nb_dir'     field could crash the application.

- A malformed UPX-compressed or ASPack-compressed  file     could     crash the application.

- A specially crafted Microsoft office document could     trigger     a infinite loop, causing a denial of service condition.

The remote host is running the F-PROT Antivirus product.

This version of F-PROT is vulnerable to a remote Denial of Service (DoS) attack when processing certain file types.  Specifically, malformed CHM, UPX-compressed, ASPack-compressed and Microsoft Office documents can cause the remote antivirus engine to crash.  An attacker exploiting this flaw would only need the ability to send an email with a malformed attachment.

ID	Name	Product	Family	Severity
36158	GLSA-200904-14 : F-PROT Antivirus: Multiple Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	medium
33549	F-PROT Antivirus Engine < 4.4.4 Multiple File Handling DoS Vulnerabilities	Nessus	Windows	medium
4593	F-PROT Attachment Handling DoS	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2008-3243

medium

Tenable Plugins

medium

medium

medium