CVE-2007-4787: Input Validation

Published Sep 10, 2007

Updated

The virus detection engine in Sophos Anti-Virus before 2.49.0 does not properly process malformed (1) CAB, (2) LZH, and (3) RAR files with modified headers, which might allow remote attackers to bypass malware detection.

Affected Software

35 affected components

Sophos Scanning Engine=2.30.4

Sophos Anti-Virus=3.4.6

Sophos Anti-Virus=3.78

Sophos Anti-Virus=3.78d

Sophos Anti-Virus=3.79

Sophos Anti-Virus=3.80

Sophos Anti-Virus=3.81

Sophos Anti-Virus=3.82

Sophos Anti-Virus=3.83

Sophos Anti-Virus=3.84

Sophos Anti-Virus=3.85

Sophos Anti-Virus=3.86

Sophos Anti-Virus=3.90

Sophos Anti-Virus=3.91

Sophos Anti-Virus=3.95

Sophos Anti-Virus=3.96

Sophos Anti-Virus=4.04

Sophos Anti-Virus=4.05

Sophos Anti-Virus=4.5.3

Sophos Anti-Virus=4.5.4

Sophos Anti-Virus=4.5.11

Sophos Anti-Virus=4.5.12

Sophos Anti-Virus=4.7.1

Sophos Anti-Virus=4.7.2

Sophos Anti-Virus=5.0.1

Sophos Anti-Virus=5.0.2

Sophos Anti-Virus=5.0.4

Sophos Anti-Virus=5.1

Sophos Anti-Virus=5.2.0

Sophos Anti-Virus=5.2.1

Sophos Anti-Virus=6.0

Sophos Anti-Virus=6.5

Sophos Anti-Virus=6.5.4_r2

Sophos Anti-Virus=6.5.8

Sophos Anti-Virus=7.0

Remediation

Patch Available

http://www.sophos.com/support/knowledgebase/article/29146.html

Event History

Sep 10, 2007

CVE Published

09:17 PM

Sep 11, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4787?

CVE-2007-4787 is classified as a medium severity vulnerability due to its potential to allow malware to bypass detection.

How do I fix CVE-2007-4787?

To fix CVE-2007-4787, upgrade your Sophos Anti-Virus software to version 2.49.0 or later.

Which versions of Sophos Anti-Virus are affected by CVE-2007-4787?

CVE-2007-4787 affects several versions of Sophos Anti-Virus including 3.80, 3.96, 4.5.x, 5.0.x, and 6.0.

What types of files are exploited in CVE-2007-4787?

CVE-2007-4787 exploits malformed CAB, LZH, and RAR files with modified headers.

Can CVE-2007-4787 affect my system remotely?

Yes, CVE-2007-4787 allows remote attackers to exploit the vulnerability to bypass malware detection.