If at first you don't succeed; call it version 1.0
Monday, October 03, 2005

A new critical vulnerability was found in the Kaspersky Antivirus engine.
According to the advisory, the vulnerability is a Heap Overflow in the CAB file format parsing engine, which can be exploited remotely by receiving a specially crafted CAB file through email or while surfing the web.
There is still no response from the vendor about this issue.
As this advisory includes a Proof of Concept, a malicious exploit will surely arrive soon.
My recommendation to all the Kaspersky Antivirus users is to currently disable CAB files monitoring, by modifying the Real Time Protection settings, until a patch will be available.

To disable Kaspersky CAB files monitoring:
1) Double click the Kaspersky icon in the system tray.
2) Click the "Settings" Tab
3) Click the "modify real time settings" link
4) In the opened window, click the "Additional settings" button.
5) In the opened window, click the "Details" button.
6) In the opened window, check the "Objects" checkbox under the "Exclude from scan" section, and click the enabled "Modify" button.
7) In the opened window, Click the "Add" button.
8) In the opened window, write "*.cab". Click "Open" Button.
9) Click the "OK" button, and again.. the "OK" Button.
10) Click on the "E-mail" tab.
11) Follow sections 5-9 to disable monitoring CAB files in email attachments.

After the patch for this security hole is available and installed, make sure you restore to the default settings by clicking the "restore default settings" link under the "Settings" tab.


Monday, October 03, 2005 10:58:48 PM UTC | Comments [0] | Security#
     All comments require the approval of the site owner before being displayed.
Name
E-mail
Home page

Comment (Some html is allowed: a@href@title, b, blockquote@cite, em, i, strike, strong, sub, super, u) where the @ means "attribute." For example, you can use <a href="" title=""> or <blockquote cite="Scott">.  

Enter the code shown (prevents robots):

Live Comment Preview
Contact Me
RSS Feeds
  
Blogroll
Archive
Admin Login
Sign In
Disclaimer
The opinions expressed herein are my own personal opinions and do not represent my employer's view in anyway.