2008.10.30 F-secure 对 FSC-2008-3 做了修正

lzbbb

与 2008.10.21 的 FSC-2008-3 比较，补丁适用产品增加了 FSAV2009 与 FSIS2009。但 FSCS8.0 与 FSWKS8 确认不在补丁适用产品中，事实上，FSCS8.0 与 FSWKS8 是在 FSC-2008-3 补丁打包（2008.10.2）之后的2008.10.9日封装的，故 FSCS8.0 与 FSWKS8 封装的时候已经包含了该补丁。
先前本人发的两个相关帖子：

http://bbs.kafan.cn/thread-352307-1-1.html

http://bbs.kafan.cn/thread-353127-1-2.html


F-Secure 安全公告 FSC-2008-3（2008-10-21，2008-10-30官方更新）

Date issued	2008-10-21
Last updated	2008-10-30
Risk level	Critical (Low/Medium/High/Critical)
Brief description	If attackers send specially-made compressed file archives to users, whose antivirus software is set to scan inside compressed archives, this causes an integer overflow. The result is a controlled buffer overflow attack. It allows the attackers to control the computer on the system level.
Mitigating factors:	Attackers can exploit the vulnerability only if the antivirus software is set to scan inside compressed archives. In general, compressed archives are scanned during scheduled scans on servers and in gateway environments. In a typical configuration, on-access scanning does not scan inside compressed archives. Therefore, attackers cannot usually exploit the vulnerability in client environments. Attackers can exploit the vulnerability by sending specially-made compressed file archives to users. At the time of publishing the Security Bulletin, there are no known exploits.
Affected platforms	All supported platforms
Clients
Products:	F-Secure Internet Security 2009 F-Secure Internet Security 2008 F-Secure Internet Security 2007 Second Edition F-Secure Internet Security 2007 F-Secure Internet Security 2006 F-Secure Anti-Virus 2009 F-Secure Anti-Virus 2008 F-Secure Anti-Virus 2007 Second Edition F-Secure Anti-Virus 2007 F-Secure Anti-Virus 2006 F-Secure Client Security 7.12 and earlier F-Secure Anti-Virus for Workstations 7.11 and earlier F-Secure Linux Security 7.01 and earlier F-Secure Anti-Virus Linux Client Security 5.54 and earlier Solutions based on F-Secure Protection Service for Consumers version 8.00 and earlier Solutions based on F-Secure Protection Service for Business version 3.10 and earlier
Risk level:	High
Servers
Products:	F-Secure Home Server Security 2009 F-Secure Anti-Virus for Windows Servers 8.00 and earlier F-Secure Anti-Virus for Citrix Servers 7.00 and earlier F-Secure Linux Security 7.01 and earlier F-Secure Anti-Virus Linux Server Security 5.54 and earlier
Risk level:	Critical
Gateways
Products:	F-Secure Anti-Virus for Microsoft Exchange 7.10 and earlier F-Secure Internet Gatekeeper for Windows 6.61 and earlier F-Secure Internet Gatekeeper for Linux 2.16 and earlier F-Secure Anti-Virus for MIMEsweeper 5.61 and earlier F-Secure Messaging Security Gateway 5.0.4 and earlier
Risk level:	Critical
Bulletin location	http://www.f-secure.com/security/fsc-2008-3.shtml
Available patches:
F-Secure deliver patches to its supported product versions that are vulnerable. For further information on supported products and F-Secure’s Product Lifecycle Policy, please see: http://www.f-secure.com/productmanagement/
Product Versions Hotfix ID Download F-Secure Client Security 7.12, 7.11 fsav744-03 ftp://ftp.f-secure.com/support/hotfix/fsavcs/fsav744-03-signed.fsfix F-Secure Anti-Virus for Workstations 7.11 7.10 fsav744-03 ftp://ftp.f-secure.com/support/hotfix/fsav/fsav744-03-signed.fsfix F-Secure Anti-Virus for Windows Servers 8.00 fsav830-01 ftp://ftp.f-secure.com/support/hotfix/fsav-server/fsav830-01-signed.fsfix F-Secure Anti-Virus for Windows Servers 7.01, 7.00 fsav722-02 ftp://ftp.f-secure.com/support/hotfix/fsav-server/fsav722-02-signed.fsfix F-Secure Anti-Virus for Citrix Servers 7.00 fsav722-02 ftp://ftp.f-secure.com/support/hotfix/fsav-server/fsav722-02-signed.fsfix F-Secure Anti-Virus for Citrix Servers 5.52 fsavsr552-16 ftp://ftp.f-secure.com/support/hotfix/fsav-server/fsavsr552-16-signed.fsfix F-Secure Linux Security 7.01 New product version 7.02 http://www.f-secure.com/webclub/fsls.html F-Secure Linux Client Security 5.54 New product build #7410 http://www.f-secure.com/webclub/fsls5.html F-Secure Linux Server Security 5.54 New product build #7410 http://www.f-secure.com/webclub/fsssl.html F-Secure Anti-Virus for Microsoft Exchange 7.10 fsavmse710-04 ftp://ftp.f-secure.com/support/hotfix/fsav-mse/fsavmse710-04.zip F-Secure Anti-Virus for Microsoft Exchange 7.00 fsavmse700-03 ftp://ftp.f-secure.com/support/hotfix/fsav-mse/fsavmse700-03.zip F-Secure Anti-Virus for Microsoft Exchange 6.62 fsavmse662-07 ftp://ftp.f-secure.com/support/hotfix/fsav-mse/fsavmse662-07.zip F-Secure Internet Gatekeeper for Windows 6.61 fsigk661-03 ftp://ftp.f-secure.com/support/hotfix/fsig/fsigk661-03.zip F-Secure Internet Gatekeeper for Linux 2.16 New product build #580 http://www.f-secure.com/webclub/fsigkl.html F-Secure Anti-Virus for MIMEsweeper 5.61 fsavsr552-16 ftp://ftp.f-secure.com/support/hotfix/fsav-server/fsavsr552-16-signed.fsfix F-Secure Messaging Security Gateway 5.0.4, 4.0.7 Packages will be available in the update channel, and installed automatically. Protection Services For Consumers 8, 7, 6, 5 Packages will be available in the update channel, and installed automatically. Protection Services For Businesses 3.1 Packages will be available in the update channel, and installed automatically. F-Secure Internet Security 2009, 2008, 2007 v.7.02, 2007, 2006 Packages will be available in the update channel, and installed automatically. F-Secure Anti-Virus 2009, 2008, 2007 v.7.02, 2007, 2006 Packages will be available in the update channel, and installed automatically. F-Secure Home Server Security 2009 Packages will be available in the update channel, and installed automatically.
Credits:	F-Secure want to thank Tamas Feher, 2F 2000 Kft., Hungary, for bringing this issue to our attention.
Revision history:	FSC-2008-10-30

Contact information:
Support: http://support.f-secure.com/enu/home/contactus/
Security: http://www.f-secure.com/security/
URL: http://www.f-secure.com/

[ 本帖最后由 lzbbb 于 2008-10-30 23:21 编辑 ]

丢三落四

嘿嘿，顶，L大，偶终于占个沙发了。

harrytien

FS动作好慢，不过终于解决了

gho

呵呵不用集成就好

wangmu_1985

喜欢FS，给老爹的机子装了，但愿以后不要再中毒

lixiangby

补丁装了的确让人感觉放心不少，不过目前对于fs的慢反应还是非常不满地……

ledled

是通过自动更新获取还是手动下载

gho

应该是手动下载