Actu
Vigil@nce: AVG Anti-Virus, denial of service via UPX
July 2008 by Vigil@nce
SYNTHESIS
A remote attacker can generate a malicious UPX file, in order to
create a denial of service during analysis.
Gravity: 1/4
Consequences: denial of service of service
Provenance: document
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: unique source (2/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 29/07/2008
Identifier: VIGILANCE-VUL-7979
IMPACTED PRODUCTS
– Grisoft AVG [confidential versions]
DESCRIPTION
Programs can be packed in order to shrink their size and make
their analyze more complex. AVG Anti-Virus supports UPX packer
(Ultimate Packer for eXecutables).
A program compacted with UPX can cause a division by zero in AVG
Anti-Virus.
A remote attacker can therefore send a compacted program in order
to generate a denial of service.
CHARACTERISTICS
Identifiers: n.runs-SA-2008.004, VIGILANCE-VUL-7979
