Overflows hit NOD32

Vulnerabilities disclosed after patching.

Two stack-overflow vulnerabilities have been disclosed in Eset's flagship NOD32 AntiVirus product, which could have been exploited to escalate privileges, or even execute code remotely and thus access a vulnerable system.

VB100

The overflow issues, which involve specially formatted pathnames which are not properly processed by the product when dealing with malware, were discovered by researcher Ismael Briones, and after initial reports to Eset are now being made public after successful patching in a very rapid turnaround.

The flaws are described as 'hard to exploit', and are thought unlikely to have been taken advantage of in the wild. Fixes for the product, released two weeks ago, should have been applied automatically during normal updates, but users are advised to ensure they are running the latest version of the product at all times.

Details of the flaws released by the researcher, without actual exploit code, are here, and a Secunia alert is here.

23 May 2007

Tags:    del.icio.us  digg this! digg this


Poll

How should software and OS patching/security updates be managed?
Manually, at the user's discretion
Automatically via an optional, user-defined schedule
Automatically via a fixed, but optional schedule
Automatically via a fixed schedule, on by default with opt-out system
Automatically and silently, with no option to run unpatched

Leave a comment
View 19 comments

Jobs Recruit Sidebar

VB100 certification

VB100 This month's comparative review tackles the 64-bit version of Windows Server 2003 - with the platform bringing out quite a number of quirks and oddities in several of the products under test.
See full results.

Virus Bulletin currently has 165,684 registered users.