alwil avast! Anti-virus Engine
Remote/Local Heap Overflow
04-July-2006

Summary
alwil software produces an anti-virus engine. The engine is capable of scanning
diverse archive formats, is purported to detect 100% of in-the-wild viruses, and is
ICSA certified. This engine is provided to OEM partners in order to enable theirproducts to scan for viruses.
While processing LHA archives, the software has insufficient checks on the datataken as input from the file. Specifically, the flaw occurs when combining thefilename and directory-name extended-header fields of LHA files. This flaw
allows a specially crafted LHA file to cause a heap-overflow in the affectedsoftware.

ImpactThis vulnerability is present by default in alwil’s avast! anti-virus engine.
Successful exploitation of these vulnerabilities results in local and remote code
execution with the full privileges of the process. By default, the privileges areequivalent to System. Exploits that leverage this vulnerability must be
lowercase-conversion resistant and not contain NULL bytes; two tractable
constraints. Thus, exploitation can be made to work reliably.

Affected software
All products that contain versions of alwil’s anti-virus engine less than Version
4.7.869 for desktops or less than version 4.7.660 for servers including:alwil software: avast! Anti-Virus
alwil software: avast! Server Edition
TN North Software: Interner Anywhere eMailServer
IceWarp Software - Merak Email Server
SmartMax Software, Inc. - MailMax Server
Paul Smith Computer Services - VPOP3 Email Server
NetWin Software - SurgeMail Email Server
Bains Digital - Defender MXCredit
This vulnerability was researched by Ryan Smith.

Contact
advisories@hustlelabs.com

Page 1 of 6

Details
The code uses a C++ class in order to decompress an LHA archive. The
following code segment shows the allocation for the class memory.

Subsequently, the program decodes the LHA header. A pointer is passed to thefunction that is 0x6F48 bytes into the previously depicted class memory. This
pointer is the first argument on the stack.

The program then uses EBP as a non-volatile reference to the second argument(arg_4) as shown in the following picture.

Next, the program begins to process an LHA extended-header. Whereappropriate, the program reads in extra data from the file. Then, depending onthe type of extended-header the program is processing, a switch statement isexecuted.

Page 2 of 6

Switch case 1, responsible for processing filename extended headers, is shownin the picture below. The program correctly guards against any size that isgreater-than 0xFF before copying the data to the field_14 buffer.

The following is switch case 2, responsible for processing extended-header
directory names. This code ensures that no more than 0x3FF bytes are copied
to the var_DNAME buffer; a correct course of action.

Page 3 of 6

The following code is executed after the program has processed a full LHA
header including the extended headers. This code concatenates two usersupplied buffers, the field_14 buffer, and the var_DNAME buffer. The previous
code shows that the resulting concatenation may be up to 0x4FE(0x3FF+0xFF+1) bytes in length.

The heap buffer’s is 0x7080 bytes in size. Since we’re writing into this buffer at
an offset of 0x6F48, with a size of 0x4FE bytes, we can write 0x3C6 bytes past
the end of the allocated memory. This vulnerability allows a standard windows
heap attack or a vtable-overwrite attack to be carried out.

Page 4 of 6

Remediation
The code should be modified to either truncate the file and pathname
combination, or to enlarge the buffer that holds the result.
Avast anti-virus Version 4.7.869 resolves this issue for the Desktop

Timeline of Events
04-July-2006 – Advisory drafted
11-July-2006 – Vendor notification
14-July-2006 – Vendor created the patch
06-August-2006 – Vendor released the patched version for the Desktop
25-August-2006 – Notification date missed due to Vendor issue
07-September-2006 – Vendor released the patched version for the Server

Page 5 of 6

Attributions
Code and cross-reference screenshots captured using IDA(http://www.datarescue.com).
Flawed code obtained from alwil software (http://www.avast.com).
The images of red mackerel tabby cats were taken from Wikipedia(http://www.wikipedia.org) and the Frederick County Animal Control Center’s
website (http://www.pethelp.net).
The Creative Commons license-notification image borrowed fromhttp://www.creativecommons.org.

LicenseThis work is licensed under the Creative Commons Attribution 2.5 License. Toview a copy of this license, visit http://creativecommons.org/licenses/by/2.5/ orsend a letter to Creative Commons, 543 Howard Street, 5th Floor, SanFrancisco, California, 94105, USA.
Attribution should be provided both in the form of a link or reference tohttp://www.hustlelabs.com and a copy of the researchers’ names listed under theCredit section of this document.
All other trademarks and copyrights referenced in this document are the propertyof their respective owners.

Page 6 of 6