BleepingComputer.com: Flaw found in Kaspersky antivirus

Flaw found in Kaspersky antivirus
By Joris Evers
Staff Writer, CNET News.com
Published: October 3, 2005, 2:24 PM PDT

A "critical" flaw in Kaspersky Lab's antivirus software could let an attacker commandeer systems that use the products... The problem lies in Kaspersky's antivirus library, security researcher Alex Wheeler wrote in an advisory...The vulnerability likely affects multiple Kaspersky products on various platforms because the library is used throughout the company's consumer and corporate software, he said...FrSirt describes the issue as "critical," its highest rating.

- http://www.techweb.com/article/printableAr..._section=700028
October 04, 2005
"...Kaspersky confirmed the vulnerability in an e-mail to TechWeb, it also said it had already stymied possible exploits by building and releasing a package of signatures that detect possible exploits. "This set of signatures was added to the anti-virus databases of Kaspersky Anti-Virus on September 29, significantly reducing the chances of successful use of the .cab vulnerability exploits," spokesman Alexey Zernov said in the e-mail. He also noted that Wheeler did not publish exploit code, a fact that would make it more difficult for attackers to leverage the vulnerabilities. Zernov also said that company developers were working on an emergency update that would include changes to the .cab scanning module. Kaspersky will release the fix Wednesday, Oct. 5..."

The company confirms the presence of a vulnerability in a Kaspersky Anti-Virus module used to process CAB files. Taking advantage of this vulnerability results in a malfunction of the antivirus program. This effect is present only in the Windows environment and does not affect other operating systems.

At the same time, Kaspersky Lab specialists have taken measures to eliminate the threat related to the CAB module vulnerability.

Importantly, version 4.5 of Kaspersky Lab's antivirus products is not affected by the vulnerability. Updates eliminating the CAB vulnerability for all the programs listed above will be released in the second half of October 5th, 2005 and will be available for installation using standard updating procedures.