Symantec AntiVirus library .rar decompression heap overflow vulnerability: Recommendations to customers

Symantec.com > Enterprise > Support > Knowledge Base

Symantec AntiVirus library .rar decompression heap overflow vulnerability: Recommendations to customers

Question/Issue:
You may have heard of a vulnerability in your Symantec Gateway Security appliance that deals with .rar archive files. You need to know whether your security gateway is vulnerable and the steps that you can take to mitigate the threat.

Solution:
Which products and versions are affected?
If you use antivirus scanning at the gateway, the following products are affected:

Symantec Gateway Security 1.0
Symantec Gateway Security 5400 Series 2.0
Symantec Gateway Security 5000 Series 3.0

Which products and versions are not affected?
If you do not use antivirus scanning at the gateway, the following products are not affected:

Symantec Gateway Security 1.0
Symantec Gateway Security 5400 Series 2.0
Symantec Gateway Security 5000 Series 3.0

The following products do not include antivirus scanning at the gateway and are not affected:

Symantec Enterprise Firewall 8.0
Symantec Clientless VPN Gateway 4400 Series 5.0
Symantec Firewall/VPN Appliance 100/200
Symantec Gateway Security 300/400 Series 2.0

Which actions should affected customers take?
Symantec Gateway Security customers should ensure that their product is up to date with LiveUpdate or Intrusion Prevention signature updates.

Symantec Gateway Security customers who use the antivirus component can download the following hotfixes from the Symantec Enterprise Support Product Updates page:

Symantec Gateway Security 5000 Series 3.0	SGS3.0-20051222-00.tgz - Antivirus component update
Symantec Gateway Security 5400 Series 2.0.1	SGS2.0.1-20051222-00.tgz - Antivirus component update
Symantec Gateway Security 1.0	SG7004-20051222-00-linux.tgz - Antivirus component update

Available Translations:

Document ID: 2005122213230354
Last Modified: 01/30/2007
Date Created: 12/22/2005
Product(s): Symantec Enterprise Firewall 6.5, Symantec Enterprise Firewall 7.x, Symantec Enterprise Firewall 8.x, Symantec Firewall/VPN Appliance, Symantec Gateway Security 300 Series, Symantec Gateway Security 400 Series, Symantec Gateway Security 5000 Series 3.0, Symantec Gateway Security 5000 Series v3.0.1, Symantec Gateway Security Appliance 1.0, Symantec Gateway Security Appliance 2.0
Release(s): 320, 360, 360R, 440, 460, 460R, 5420, 5440, 5441, 5460, 5461, 5620, 5640, 5660, SGS 440, SGS 460, SGS 460R, SGS 5620, SGS 5640, SGS 5660, Symantec Enterprise Firewall 6.5.2, Symantec Enterprise Firewall 7.0, Symantec Enterprise Firewall 7.04, Symantec Enterprise Firewall 8.0, Symantec Firewall/VPN 100, Symantec Firewall/VPN 200, Symantec Firewall/VPN 200R, Symantec Gateway Security Appliance 1.0, Symantec Gateway Security Appliance 2.0 [All Releases]