DoS Buffer Overflow in McAfee?
A post to the Full Disclosure list reports a local denial of service in McAfee Antivirus Enterprise 8.
http://seclists.org/lists/fulldisclosure/2006/Jul/0157.html From: John DoeDate: Sun, 9 Jul 2006 10:53:21 -0700 (PDT) A local Buffer Overflow was discovered in McAfee VirusScan Enterprise 8.0.0.
The overflow can be triggered within the "Buffer OverFlow Protection Properties" by creating a buffer overflow exclusion. Then fill each field with data, and click ok, and apply
Process name: AAAAAAAAAAAAAAAAA......etc
Module name: AAAAAAAAAAAAAAAAAA......etc
API name: AAAAAAAAAAAAAAAAAAAAA......etcThis will trigger various exceptions based on amount of data added to each field.
This will DoS the AV . McAfee AV will not run correctly again until Buffer Overflow Protection is disabled or the Buffer Overflow Exclusion is removed.
Categories
Antivirus0 TrackBacks
Listed below are links to blogs that reference this entry: DoS Buffer Overflow in McAfee?.
TrackBack URL for this entry: http://www.infosecblog.org/mt-tb20071121.pl/238




Leave a comment
Powered by Ajax Comments