F-Secure 安全公告 FSC-2008-3（2008-10-21）

lzbbb

Date issued	2008-10-21
Last updated	2008-10-21
Risk level	Critical (Low/Medium/High/Critical)
Brief description	If attackers send specially-made compressed file archives to users, whose antivirus software is set to scan inside compressed archives, this causes an integer overflow. The result is a controlled buffer overflow attack. It allows the attackers to control the computer on the system level.
Mitigating factors:	Attackers can exploit the vulnerability only if the antivirus software is set to scan inside compressed archives. In general, compressed archives are scanned during scheduled scans on servers and in gateway environments. In a typical configuration, on-access scanning does not scan inside compressed archives. Therefore, attackers cannot usually exploit the vulnerability in client environments. Attackers can exploit the vulnerability by sending specially-made compressed file archives to users. At the time of publishing the Security Bulletin, there are no known exploits.
Affected platforms	All supported platforms
Clients
Products:	F-Secure Internet Security 2008 F-Secure Internet Security 2007 Second Edition F-Secure Internet Security 2007 F-Secure Internet Security 2006 F-Secure Anti-Virus 2008 F-Secure Anti-Virus 2007 Second Edition F-Secure Anti-Virus 2007 F-Secure Anti-Virus 2006 F-Secure Client Security 7.12 and earlier F-Secure Anti-Virus for Workstations 7.11 and earlier F-Secure Linux Security 7.01 and earlier F-Secure Anti-Virus Linux Client Security 5.54 and earlier Solutions based on F-Secure Protection Service for Consumers version 8.00 and earlier Solutions based on F-Secure Protection Service for Business version 3.10 and earlier
Risk level:	High
Servers
Products:	F-Secure Home Server Security 2009 F-Secure Anti-Virus for Windows Servers 8.00 and earlier F-Secure Anti-Virus for Citrix Servers 7.00 and earlier F-Secure Linux Security 7.01 and earlier F-Secure Anti-Virus Linux Server Security 5.54 and earlier F-Secure Anti-Virus for Linux Servers 4.65
Risk level:	Critical
Gateways
Products:	F-Secure Anti-Virus for Microsoft Exchange 7.10 and earlier F-Secure Internet Gatekeeper for Windows 6.61 and earlier F-Secure Internet Gatekeeper for Linux 2.16 and earlier F-Secure Anti-Virus for Linux Gateways 4.65 F-Secure Anti-Virus for MIMEsweeper 5.61 and earlier F-Secure Messaging Security Gateway 5.0.4 and earlier
Risk level:	Critical
Bulletin location	http://www.f-secure.com/security/fsc-2008-3.shtml
Available patches:
F-Secure deliver patches to its supported product versions that are vulnerable. For further information on supported products and F-Secure’s Product Lifecycle Policy, please see: http://www.f-secure.com/productmanagement/
Product Versions Hotfix ID Download F-Secure Client Security 7.12, 7.11 fsav744-03 ftp://ftp.f-secure.com/support/hotfix/fsavcs/fsav744-03-signed.fsfix F-Secure Anti-Virus for Workstations 7.11 7.10 fsav744-03 ftp://ftp.f-secure.com/support/hotfix/fsav/fsav744-03-signed.fsfix F-Secure Anti-Virus for Windows Servers 8.00 fsav830-01 ftp://ftp.f-secure.com/support/hotfix/fsav-server/fsav830-01-signed.fsfix F-Secure Anti-Virus for Windows Servers 7.01, 7.00 fsav722-01 ftp://ftp.f-secure.com/support/hotfix/fsav-server/fsav722-01-signed.fsfix F-Secure Anti-Virus for Citrix Servers 7.00 fsav722-01 ftp://ftp.f-secure.com/support/hotfix/fsav-server/fsav722-01-signed.fsfix F-Secure Anti-Virus for Citrix Servers 5.52 fsavsr552-16 ftp://ftp.f-secure.com/support/hotfix/fsav-server/fsavsr552-16-signed.fsfix F-Secure Linux Security 7.01 New product version 7.02 http://www.f-secure.com/webclub/fsls.html F-Secure Linux Client Security 5.54 New product build #7410 http://www.f-secure.com/webclub/fsls5.html F-Secure Linux Server Security 5.54 New product build #7410 http://www.f-secure.com/webclub/fsssl.html F-Secure Anti-Virus for Linux Servers 4.65 New product build #7400 http://www.f-secure.com/webclub/fsavsrvl.html F-Secure Anti-Virus for Microsoft Exchange 7.10 fsavmse710-04 ftp://ftp.f-secure.com/support/hotfix/fsav-mse/fsavmse710-04.zip F-Secure Anti-Virus for Microsoft Exchange 7.00 fsavmse700-03 ftp://ftp.f-secure.com/support/hotfix/fsav-mse/fsavmse700-03.zip F-Secure Anti-Virus for Microsoft Exchange 6.62 fsavmse662-07 ftp://ftp.f-secure.com/support/hotfix/fsav-mse/fsavmse662-07.zip F-Secure Internet Gatekeeper for Windows 6.61 fsigk661-03 ftp://ftp.f-secure.com/support/hotfix/fsig/fsigk661-03.zip F-Secure Internet Gatekeeper for Linux 2.16 New product build #580 http://www.f-secure.com/webclub/fsigkl.html F-Secure Anti-Virus for MIMEsweeper 5.61 fsavsr552-16 ftp://ftp.f-secure.com/support/hotfix/fsav-server/fsavsr552-16-signed.fsfix F-Secure Anti-Virus for Linux Gateways 4.65 New product build #7400 http://www.f-secure.com/webclub/fsavgwl.html F-Secure Messaging Security Gateway 5.0.4, 4.0.7 Packages will be available in the update channel, and installed automatically. Protection Services For Consumers 8, 7, 6, 5 Packages will be available in the update channel, and installed automatically. Protection Services For Businesses 3.1 Packages will be available in the update channel, and installed automatically. F-Secure Internet Security 2008, 2007 v.7.02, 2007, 2006 Packages will be available in the update channel, and installed automatically. F-Secure Anti-Virus 2008, 2007 v.7.02, 2007, 2006 Packages will be available in the update channel, and installed automatically. F-Secure Home Server Security 2009 Packages will be available in the update channel, and installed automatically.
Credits:	F-Secure want to thank Tamas Feher, 2F 2000 Kft., Hungary, for bringing this issue to our attention.
Revision history:	FSC-2008-10-21

Contact information:
Support: http://support.f-secure.com/enu/home/contactus/
Security: http://www.f-secure.com/security/
URL: http://www.f-secure.com/

lzbbb

风险等级：危急

描述：

如果攻击者发送特制的压缩文件存档给用户，其防病毒软件设置为扫描压缩文件内部，这会造成一个整体溢出。其结果是控制的缓冲区溢出攻击。它允许攻击者控制计算机系统。

受影响系统：见一楼，注意  F-Secure Client Security 7.12 及其早期版本需更新，F-Secure Internet Security 2008 及其早期版本需更新。
                                            F-Secure Client Security 8.00  及  F-Secure Internet Security 2009 不在需更新列表中。

[ 本帖最后由 lzbbb 于 2008-10-21 20:36 编辑 ]

kris

谢谢L大
还好我用的工作站8.00版未在此列。

本拉稀

由此可见，使用V大和L大在10月15日发布的最新版本的FSCS的同学可以不用安装此次的重要补丁。

gho

是啊CS 8.0不需要更新

aura

这两天FS的日子不太好过呀

丢三落四

嘿嘿，偶的版本不用更新。

yuna

我的也是用8.0的了！