Sophos Anti-Virus XSS Vulnerability Analysis (CVE-2007-4512)

Vulnerability Key Information Vulnerability Name: Cross Site Scripting Vulnerability in Sophos Anti-Virus Affected System: Sophos Anti-Virus, version 6.5.4 R2 Severity: Medium Category: Cross Site Scripting Author: Context Information Security Ltd Announcement Date: 6th September 2007 Description A ZIP archive containing a virus signature with a malformed file name will trigger a Cross Site Scripting vulnerability within the Sophos Anti-Virus client. Analysis When Sophos anti-virus scans a specially crafted ZIP archive containing an XSS attack string, it internally logs the string. When this information is accessed via the Sophos client (SavMain.exe), the XSS attack string is displayed unencoded. When the print function is invoked, the application can be exploited to execute arbitrary code on the target machine from an external attacker's submitted file. Solution Update to version 6.5.8 or 7.0. Vendor Response Sophos has patched this issue in version 7.01. CVE Details This issue has been provisionally assigned a CVE candidate number of CVE-2007-4512. Disclosure Timeline 18 April 2007: Initial Discovery and vendor notification 19 April 2007: Vendor Response 21 August 2007: Second Vendor Response 6 September 2007: Coordinated Public Release Acknowledgements Michael Jordon of Context Information Security Ltd

Goal Reached Thanks to every supporter — we hit 100%!

Sophos Anti-Virus XSS Vulnerability Analysis (CVE-2007-4512)