Detections
Analytics

AVG Scanning Engine UPX Parsing Denial of Service Vulnerability

medium Nessus Network Monitor Plugin ID 5021

Synopsis

The remote host is vulnerable to a flaw which allows malcode to be passed

Description

AVG Anti-Virus is installed on the remote Windows host. The version of AVG Anti-Virus installed on the remote host is affected by a flaw wherein remote attackers can bypass the scanning engine by sending specially formatted 'rar' and 'zip' archive files. An attacker, exploiting this flaw, would only need the ability to send email to valid recipients on the target server. Successful exploitation would result in the attacker being able to pass malware through the AVG server.

Solution

Upgrade to AVG 8.5 323 or later.

See Also

http://blog.zoller.lu/2009/04/avg-zip-evasion-bypass.html

Plugin Details

Severity: Medium

ID: 5021

Family: Web Clients

Published: 8/18/2004

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:X

Vulnerability Information

CPE: cpe:/a:avg:anti-virus

Reference Information

CVE: CVE-2009-1784

BID: 34895