The Symantec AntiVirus RAR Archive Decompression Buffer Overflow vulnerability could allow an attacker to gain control of a system. The vulnerability affects at least 39 different Symantec antivirus products, according to an advisory from security firm Secunia.
Secunia credits security researcher Alex Wheeler for discovering the flaw, which allegedly exists within the Symantec Antivirus library and could potentially allow for multiple heap overflows when Symantec's products scan a malicious RAR archive.
A RAR archive is a compressed archive file (similar to a Zip file).https://o1.qnsr.com/log/p.gif?;n=203;c=204660766;s=9477;x=7936;f=201812281312070;u=j;z=TIMESTAMP;a=20392931;e=iAccording to Wheeler's advisory, "These vulnerabilities can be exploited remotely without user interaction in default configurations through common protocols such as SMTP."
Users of Symantec's antivirus products are warned to disable scanning of RAR compressed files until such time as the vulnerable code has been patched.
Symantec is now claiming that its security response team has in fact posted an AntiVirus based protection signature to LiveUpdate providing a heuristic detection for potential exploits of the Symantec decomposer RAR archive vulnerability.
According to Symantec, the update signature is available to all desktop, server and gateway product versions of Symantec's security products and appliance solutions that contain the decomposer RAR archive.