Description
Multiple Sophos Anti-Virus products, including Anti-Virus for Windows 5.x before 5.2.1 and 4.x before 4.05, when cabinet file inspection is enabled, allows remote attackers to execute arbitrary code via a CAB file with "invalid folder count values," which leads to heap corruption.
References
- http://www.zerodayinitiative.com/advisories/ZDI-06-012.html
- 1016041 vdb-entry
- 869 third-party-advisory
- sophos-cab-parsing-bo(26305) vdb-entry
- 20060508 ZDI-06-012: Sophos Anti-Virus CAB Unpacking Code Execution Vulnerability mailing-list
- 17876 vdb-entry
- 20060508 ZDI-06-012: Sophos Anti-Virus CAB Unpacking Code Execution Vulnerability mailing-list
- 20028 third-party-advisory
- ADV-2006-1730 vdb-entry