HTTP: Sophos Anti-Virus Malicious Visio File Attack

This signature detects attempts to exploit a known vulnerability in Sophos Anti-Virus. Sophos is vulnerable to a signed integer overflow. If a malformed Microsoft Visio file is scanned for viruses by Sophos AV, the Sophos process could be taken over and arbitrary code executed as SYSTEM. Microsoft Visio does not need to be installed in order to exploit Sophos AV in this manner. Because of the complexity of Visio files, it is possible this signature can false positive and therefore should only be used in Internet-facing policies.

Extended Description

A remote heap overflow vulnerability exists in Sophos Anti-Virus Library when scanning Visio files. This issue is due to a failure of the library to properly bounds check user-supplied input prior to copying data to an internal memory buffer.

Affected Products

4d webstar

References

BugTraq: 14362

CVE: CVE-2005-2768

URL: http://www.rem0te.com/public/images/sophos.pdf http://www.sans.org/newsletters/risk/display.php?v=4&i=30#05.30.26

Short Name

HTTP:STC:DL:SOPHOS-MAL-VISIO

Severity

Critical

Recommended

False

Recommended Action

Drop

HTTP: Sophos Anti-Virus Malicious Visio File Attack

Extended Description

Affected Products

References

Found a potential security threat?