Software Engineering Institute

The McAfee Antivirus products feature the ability to detect malicious code in a number of compressed files, including those in the LHA format. A buffer overflow error has been discovered in the way that the McAfee Scan Engine handles the "type 2" headers in an LHA file. A remote attacker with the ability to craft a specifically malfomed LHA file may be able to exploit this vulnerability by introducing the malformed LHA file to an affected system via a web or FTP server, email message, or file server.

McAfee lists the following products as being potentially vulnerable to this issue, depending on the version of the scan engine they use:

• McAfee InternetSecurity Suite
• VirusScan (all versions)
• VirusScan Professional
• Active Mail Protection
• Active Threat Protection
• Active Virus Defense SMB Edition
• Active VirusScan SMB Edition
• GroupShield for Exchange
• GroupShield for Exchange 5.5
• GroupShield for Lotus Domino
• GroupShield for Mail Servers with ePO
• LinuxShield
• Managed VirusScan
• NetShield for Netware
• PortalShield for Microsoft SharePoint
• SecurityShield for Microsoft ISA Server
• Virex
• VirusScan ASaP
• VirusScan Command Line
• VirusScan Enterprise 8.0i
• VirusScan for NetApp
• WebShield Appliances
• WebShield SMTP

An unauthenticated remote attacker may be able to execute code of their choosing on a vulnerable system. The attacker-supplied code would be run with Local System privileges, resulting in a complete system compromise.

Apply an update from the vendor
McAfee has published updated versions of the Scan Engine (version 4400 - released November 2004) and DAT file (version 4436 - released March 1, 2005) to address this vulnerability. Users are encouraged to review the McAfee FAQ and McAfee advisory on this issue and update their products accordingly.