SUMMARY

Symantec is aware of a buffer overflow in its AntiVirus component used to decompose RAR (Roshal Archive). A specially crafted RAR file could potentially cause this buffer overflow to occur and possibly execute hostile content from the RAR file on the targeted system.

Risk Impact
High

AFFECTED PRODUCTS

Vulnerable Products

1. As Symantec continues to investigate this issue, the list of affected products may be updated.
2. Product updates will be available from the Symantec support site: http://www.symantec.com/techsupp/ or via LiveUpdate when available.
3. Only currently supported Symantec Products will be updated. Customers using unsupported versions are encouraged to upgrade to a supported version.
4. Some product updates are available via Symantec LiveUpdate. Users will need to perform a manual LiveUpdate to receive and install these product updates.
   
   To perform a manual update using Symantec LiveUpdate, users should:
   • Open any installed Symantec product
   • Click on LiveUpdate in the toolbar
   • Run LiveUpdate until all available Symantec product updates are downloaded and installed
5. Product updates will initially be available for the English language versions. Localized versions of the update will be available as soon as fully tested. Please check for localized updates at your normal product support location.

To date, Symantec has not had any reports of attempts to exploit or customers impacted by this vulnerability.

Affected Enterprise Products

Affected Consumer Products

ADDITIONAL PRODUCT INFORMATION

Products Not Affected

ISSUES

A specially crafted RAR file could potentially cause this buffer overflow to occur and possibly execute hostile content from the RAR file on the targeted system.

The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE-2005-4438 to this issue.

MITIGATION

Symantec Response
Symantec is currently building, testing and distributing product updates for all supported affected products.

Mitigations
Symantec Security Response posted an antivirus based protection signature to LiveUpdate on December 20, 2005, providing a heuristic detection for potential exploits of the Symantec decomposer RAR archive vulnerability. This signature is available though LiveUpdate, to all desktop, server and gateway product versions of Symantec's Security products and appliance solutions that contain the decomposer RAR archive. Symantec strongly recommends that customers immediately ensure their products are up-to-date to protect against possible threats.

Customers may also mitigate the risk to the antivirus component by disabling scanning of RAR compressed files until the vulnerable code is fixed. However, it is important to note that disabling RAR scanning may allow RAR files containing viruses through the security gateway.

Instructions to disable scanning of RAR compressed files for Symantec gateway products can be found at: http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2005122213230354

To Disable scanning of RAR files in Auto-Protect for Norton AntiVirus 9 and Norton AntiVirus 10:

1. Open the System Preferences
2. Select the Norton Auto-Protect preference pane
3. Set 'Scan Compressed Files' to 'Off'
4. Close the System Preferences

This will disable the use of the Decomposer Engine when Auto-Protect is scanning files.

ACKNOWLEDGEMENTS

Symantec thanks Alex Wheeler for providing coordination and working with Symantec to resolve this issue

REVISION

Revision History
12/22/05 - Updated product matrix, Additional mitigations
12/28/05 - Additional product updates, Refined mitigation
12/30/05 - Additional product updates
01/03/06 - Additional product updates
01/05/06 - Additional product updates
01/12/06 - Additional product updates
01/18/06 - Additional product updates
01/24/06 - Additional product updates
01/27/06 - Additional product updates