Question
Sophos have published a report on the vulnerabilities that refer to the scanning of CHM files.
It should be noted that these vulnerabilities represent theoretical risks and there are no known exploits of these vulnerabilities at the time of publication.
CHM File heap overflow vulnerability (DoS) -
A heap overflow will occur when scanning CHM files, if they have been crafted with a combination of very specific values for certain settings.
CHM name length memory consumtion vulnerability (DoS) -
A malformed CHM file with certain characteristics regarding the CHM chunk header will cause a memory corruption to occur.
This article addresses this issue due to the fact that starting with 8.4.0 the Vital Security NG opens CHM files internally and lets the AV scan all the files encapsulated inside the CHM . How do I disable the scanning of these CHM files?
Answer
Sophos is currently working to ensure that all of its products are protected against these issues.
As a workaround solution, to disable scanning CHM files with Sophos we recommend to modify the set of policy rules that use the Sophos engine with an additional condition: True Content Type is not equal to CHM.
The Default Security Policy has two rules that use the Sophos engine:
Block Known Viruses (Sophos)
Block Unscannable (Sophos)
Software Version
8.4.0
- This article applies to:
- NG 1000
- NG 5000
- NG 8000
- This article was previously published as:
- Finjan KB 1346